Linux Process Sets HTTP/HTTPS Proxy Environment Variables

ATT&CK techniques

C2

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1090Proxy
Exfiltration
Impact

What it detects

This rule flags Linux process creations where the command line includes proxy environment variable assignments for both http_proxy= and https_proxy=. Attackers may use proxy settings to route outbound traffic through intermediate systems for command-and-control or to evade direct network visibility. Detection relies on process creation telemetry and specifically inspects the process command line for these substrings.

Reporting behind it

github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_proxy_connection.yml

Related detections9 linkedT1090 — drag to rearrange

Suspicious Flax Typhoon System Utility Masquerade Outside System32 via Renamed VPN Client (via process_creation)

Possible Credential Stuffing Blocked by Conditional Access in Microsoft 365

Possible ReverseSocks5 Tunneling Tool Execution on Linux (via process_creation)

Malicious GhostSocks Loader Execution with johnpidar Argument via process_creation

Malicious Chisel Reverse SOCKS Proxy Execution (via process_creation)

Malicious QEMU Covert Network Tunnel via User-Mode netdev Socket (via process_creation)

Malicious Tunneling Tool Execution on Linux Host (via process_creation)

Suspicious Chisel Reverse Tunnel Execution by UAT-9686

Suspicious macOS Trojan-Proxy LaunchAgent GoogleHelperUpdater Persistence (via file_event)

Linux Process Sets HTTP/HTTPS Proxy Environment Variables

Pivot detection · T1090 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-process-sets-http-proxy-https-proxy-environment-variables-72f4ab3f

title: Linux Process Sets HTTP/HTTPS Proxy Environment Variables
id: 0d14b7ab-99f5-412c-ab52-f6bbfc41ff1e
status: test
description: This rule flags Linux process creations where the command line includes proxy environment variable assignments for both http_proxy= and https_proxy=. Attackers may use proxy settings to route outbound traffic through intermediate systems for command-and-control or to evade direct network visibility. Detection relies on process creation telemetry and specifically inspects the process command line for these substrings.
author: Ömer Günal, Huntrule Team
date: 2020-06-17
modified: 2022-10-05
tags:
  - attack.command-and-control
  - attack.t1090
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    CommandLine|contains:
      - http_proxy=
      - https_proxy=
  condition: selection
falsepositives:
  - Legitimate administration activities
level: low
license: DRL-1.1
related:
  - id: 72f4ab3f-787d-495d-a55d-68c2ff46cf4c
    type: derived
references:
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_proxy_connection.yml

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL