Windows Process Creation: 3proxy Proxy Server Execution
Detects execution of 3proxy.exe with local 127.0.0.1 proxy binding on Windows.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-09-13
- Updated
- 2026-07-30
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags Windows process creation events where the executable filename ends with \3proxy.exe and the process description indicates it is "3proxy - tiny proxy server". It further narrows matches by looking for command lines containing the common 127.0.0.1 proxy binding pattern (".exe -i127.0.0.1 -p"). Attackers may use 3proxy to enable local proxying for command-and-control or to route traffic through compromised hosts, so execution telemetry is important for early identification.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: 3proxy Proxy Server Execution"
id: beac9b48-3ff9-445f-ad59-552967e5f67c
status: test
description: This rule flags Windows process creation events where the executable filename ends with \3proxy.exe and the process description indicates it is "3proxy - tiny proxy server". It further narrows matches by looking for command lines containing the common 127.0.0.1 proxy binding pattern (".exe -i127.0.0.1 -p"). Attackers may use 3proxy to enable local proxying for command-and-control or to route traffic through compromised hosts, so execution telemetry is important for early identification.
references:
- https://github.com/3proxy/3proxy
- https://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_3proxy_execution.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-09-13
modified: 2023-02-21
tags:
- attack.command-and-control
- attack.t1572
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith: \3proxy.exe
selection_pe:
Description: 3proxy - tiny proxy server
selection_params:
CommandLine|contains: .exe -i127.0.0.1 -p
condition: 1 of selection_*
falsepositives:
- Administrative activity
level: high
license: DRL-1.1
related:
- id: f38a82d2-fba3-4781-b549-525efbec8506
type: derived