Windows Process Execution of Common Tunneling Tools (httptunnel, plink, socat, stunnel)
Alerts on Windows execution of htptunnel.exe, plink.exe, socat.exe, or stunnel.exe that may be used for tunneling.
- Product
- windows
- Category
- process_creation
- Author
- Daniil Yugoslavskiy, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2019-10-24
- Updated
- 2026-07-31
ATT&CK techniques
C2 → ExfiltrationRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule matches process creation events where the executable path ends with httptunnel.exe, plink.exe, socat.exe, or stunnel.exe. These tools can be abused to establish network tunnels that facilitate command-and-control and potential data exfiltration. Detection relies on Windows process creation telemetry, specifically the executable filename from the process image.
Reporting behind it
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_susp_exfil_and_tunneling_tool_execution.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Process Execution of Common Tunneling Tools (httptunnel, plink, socat, stunnel)
id: 192f1e74-910e-422b-8a67-5d4ea817dd79
status: test
description: This rule matches process creation events where the executable path ends with httptunnel.exe, plink.exe, socat.exe, or stunnel.exe. These tools can be abused to establish network tunnels that facilitate command-and-control and potential data exfiltration. Detection relies on Windows process creation telemetry, specifically the executable filename from the process image.
author: Daniil Yugoslavskiy, oscd.community, Huntrule Team
references:
- https://www.microsoft.com/en-us/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_susp_exfil_and_tunneling_tool_execution.yml
date: 2019-10-24
modified: 2024-01-18
tags:
- attack.exfiltration
- attack.command-and-control
- attack.t1041
- attack.t1572
- attack.t1071.001
- detection.threat-hunting
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- \httptunnel.exe
- \plink.exe
- \socat.exe
- \stunnel.exe
condition: selection
falsepositives:
- Legitimate administrators using one of these tools
level: medium
license: DRL-1.1
related:
- id: c75309a3-59f8-4a8d-9c2c-4c927ad50555
type: derived