Windows: Execution of Htran/NATBypass HackTool Binaries or Tran/Slave CLI Flags
Detects Windows executions of htran.exe or lcx.exe and command lines containing -tran or -slave flags.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-12-27
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags process creation events where the executed image name ends with known Htran/NATBypass-related binaries, or where the command line contains invocation patterns consistent with tran and slave modes. Such tooling can be used to establish attacker-controlled networking or command-and-control pathways, making execution of these components a high-signal indicator. It relies on Windows process creation telemetry, specifically the executable image path and the command-line string.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Execution of Htran/NATBypass HackTool Binaries or Tran/Slave CLI Flags"
id: 2b18342b-adaa-4483-bee8-11516683d822
status: test
description: This rule flags process creation events where the executed image name ends with known Htran/NATBypass-related binaries, or where the command line contains invocation patterns consistent with tran and slave modes. Such tooling can be used to establish attacker-controlled networking or command-and-control pathways, making execution of these components a high-signal indicator. It relies on Windows process creation telemetry, specifically the executable image path and the command-line string.
references:
- https://github.com/HiwinCN/HTran
- https://github.com/cw1997/NATBypass
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_htran_or_natbypass.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-12-27
modified: 2023-02-04
tags:
- attack.command-and-control
- attack.t1090
- attack.s0040
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- \htran.exe
- \lcx.exe
selection_cli:
CommandLine|contains:
- ".exe -tran "
- ".exe -slave "
condition: 1 of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: f5e3b62f-e577-4e59-931e-0a15b2b94e1e
type: derived