huntrule

Possible Connection Proxy (via process_creation)

This rule detects setting proxy configuration

SigmalowLinuxv1
sigma
title: Possible Connection Proxy (via process_creation)
id: c5d66ed2-f43d-50cd-b42d-9ce36eb23814
status: stable
description: This rule detects setting proxy configuration
author: Huntrule Team
date: 2026-04-14
tags:
    - attack.command-and-control
    - attack.t1090
logsource:
    product: linux
    category: process_creation
detection:
    selection:
        CommandLine|contains:
            - 'http_proxy='
            - 'https_proxy='
    condition: selection
falsepositives:
    - Unknown
level: low
references:
    - https://attack.mitre.org/techniques/T1090/

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.