SEKOIA.IO Rules high stable sigma

SOCKS Tunneling Tool

Detects the usage of a SOCKS tunneling tool, often used by threat actors. These tools often use the socks5 commandline argument, however socks4 can sometimes be used as well. Unfortunately, socks alone (without any number) triggered too many false positives.

View Source

Detection Logic

selection:
  process.command_line
| contains:
    - socks5
    - socks4
    - --tls-skip-verify
condition: selection

Field Validations

Loading…

Comments (0)

Loading comments...