Windows Process Creation: 3proxy Proxy Server Execution

Detects execution of 3proxy.exe with local 127.0.0.1 proxy binding on Windows.

FreeReviewedSigma · High · v1

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-09-13
Updated: 2026-07-30

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1572Protocol Tunneling
Exfiltration
Impact

What it detects

This rule flags Windows process creation events where the executable filename ends with \3proxy.exe and the process description indicates it is "3proxy - tiny proxy server". It further narrows matches by looking for command lines containing the common 127.0.0.1 proxy binding pattern (".exe -i127.0.0.1 -p"). Attackers may use 3proxy to enable local proxying for command-and-control or to route traffic through compromised hosts, so execution telemetry is important for early identification.

Reporting behind it

Related detections9 linkedT1572 — drag to rearrange

Suspicious SSH Reverse Tunnel Establishment (via process_creation)

Suspicious Cloudflared Tunnel Persistence Installed via msiexec (via process_creation)

Suspicious Renamed Tunneling Tool Executing from Windows Tasks Directory

Suspicious Reverse SSH Tunnel Creation with Host Key Verification Disabled (via process_creation)

Malicious Abyss Locker wmihelper SSH Backdoor Deployment (via file_event)

Malicious GS-Netcat Command and Control via Global Socket Relay Network (via dns_query)

Suspicious Microsoft Dev Tunnel Domain Resolution via DNS (via dns_query)

Suspicious DNS Query to Dynamic DNS and Tunneling Providers Abused by RATs

Suspicious SSH Reverse Tunnel Over DNS Port

Windows Process Creation: 3proxy Proxy Server Execution

Pivot detection · T1572 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-3proxy-proxy-server-execution-f38a82d2

title: "Windows Process Creation: 3proxy Proxy Server Execution"
id: beac9b48-3ff9-445f-ad59-552967e5f67c
status: test
description: This rule flags Windows process creation events where the executable filename ends with \3proxy.exe and the process description indicates it is "3proxy - tiny proxy server". It further narrows matches by looking for command lines containing the common 127.0.0.1 proxy binding pattern (".exe -i127.0.0.1 -p"). Attackers may use 3proxy to enable local proxying for command-and-control or to route traffic through compromised hosts, so execution telemetry is important for early identification.
references:
  - https://github.com/3proxy/3proxy
  - https://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_3proxy_execution.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-09-13
modified: 2023-02-21
tags:
  - attack.command-and-control
  - attack.t1572
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: \3proxy.exe
  selection_pe:
    Description: 3proxy - tiny proxy server
  selection_params:
    CommandLine|contains: .exe -i127.0.0.1 -p
  condition: 1 of selection_*
falsepositives:
  - Administrative activity
level: high
license: DRL-1.1
related:
  - id: f38a82d2-fba3-4781-b549-525efbec8506
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL