Windows Process Creation: 3proxy Proxy Server Execution

title: "Windows Process Creation: 3proxy Proxy Server Execution"
id: beac9b48-3ff9-445f-ad59-552967e5f67c
status: test
description: This rule flags Windows process creation events where the executable filename ends with \3proxy.exe and the process description indicates it is "3proxy - tiny proxy server". It further narrows matches by looking for command lines containing the common 127.0.0.1 proxy binding pattern (".exe -i127.0.0.1 -p"). Attackers may use 3proxy to enable local proxying for command-and-control or to route traffic through compromised hosts, so execution telemetry is important for early identification.
references:
  - https://github.com/3proxy/3proxy
  - https://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_3proxy_execution.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-09-13
modified: 2023-02-21
tags:
  - attack.command-and-control
  - attack.t1572
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: \3proxy.exe
  selection_pe:
    Description: 3proxy - tiny proxy server
  selection_params:
    CommandLine|contains: .exe -i127.0.0.1 -p
  condition: 1 of selection_*
falsepositives:
  - Administrative activity
level: high
license: DRL-1.1
related:
  - id: f38a82d2-fba3-4781-b549-525efbec8506
    type: derived