Linux Process Sets http_proxy/https_proxy Environment Variables

Flags Linux process command lines that set http_proxy and https_proxy values, indicating proxy configuration.

FreeUnreviewedSigmalowv1

linux-process-sets-http-proxy-https-proxy-environment-variables-72f4ab3f

title: Linux Process Sets http_proxy/https_proxy Environment Variables
id: 0d14b7ab-99f5-412c-ab52-f6bbfc41ff1e
status: test
description: This rule catches Linux process executions where the command line contains http_proxy= and https_proxy= assignments, indicating proxy configuration changes for outbound traffic. Attackers may use this to redirect command-and-control or other internet-bound communications through a proxy. Telemetry relies on process creation events that include the full command line.
author: Ömer Günal, Huntrule Team
date: 2020-06-17
modified: 2022-10-05
tags:
  - attack.command-and-control
  - attack.t1090
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    CommandLine|contains:
      - http_proxy=
      - https_proxy=
  condition: selection
falsepositives:
  - Legitimate administration activities
level: low
license: DRL-1.1
related:
  - id: 72f4ab3f-787d-495d-a55d-68c2ff46cf4c
    type: derived
references:
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_proxy_connection.yml

What it detects

This rule catches Linux process executions where the command line contains http_proxy= and https_proxy= assignments, indicating proxy configuration changes for outbound traffic. Attackers may use this to redirect command-and-control or other internet-bound communications through a proxy. Telemetry relies on process creation events that include the full command line.

Known false positives

Legitimate administration activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.