Potential Network Traffic Tunneling via Proxychains


Description

This rule identifies the use of proxychains to potentially tunnel network traffic. Attackers can leverage proxychains to establish hidden communication channels and gain unauthorized access to internal resources, facilitating data exfiltration or lateral movement via proxychains while evading direct connection blocking.

Query · eql

process where event.type == "start" and event.action == "exec" and process.name in ("proxychains", "proxychains4", "proxyresolv")
Raw source Potential Network Traffic Tunneling via Proxychains · Elastic TOML
Esc
Published by elastic/protections-artifacts ↗, licensed under Elastic License 2.0 ↗. Reproduced here unmodified.
[rule]
description = """
This rule identifies the use of proxychains to potentially tunnel network traffic. Attackers can leverage proxychains to
establish hidden communication channels and gain unauthorized access to internal resources, facilitating data
exfiltration or lateral movement via proxychains while evading direct connection blocking.
"""
id = "4484d4b4-499f-4c8e-aa32-be7c0d66eb6c"
license = "Elastic License v2"
name = "Potential Network Traffic Tunneling via Proxychains"
os_list = ["linux"]
reference = [
    "https://book.hacktricks.xyz/generic-methodologies-and-resources/tunneling-and-port-forwarding",
    "https://github.com/haad/proxychains",
]
version = "1.0.1"

query = '''
process where event.type == "start" and event.action == "exec" and process.name in ("proxychains", "proxychains4", "proxyresolv")
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1572"
name = "Protocol Tunneling"
reference = "https://attack.mitre.org/techniques/T1572/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.