Windows Process Execution of Common Tunneling and Proxy Tools

title: Windows Process Execution of Common Tunneling and Proxy Tools
id: 192f1e74-910e-422b-8a67-5d4ea817dd79
status: test
description: This rule flags process creation events where the executable path ends with htptunnel.exe, plink.exe, socat.exe, or stunnel.exe on Windows. These commonly available tools can be repurposed to tunnel traffic and support command-and-control or data exfiltration. Detection relies on process_creation telemetry and matching the process image name suffix to the listed binaries.
author: Daniil Yugoslavskiy, oscd.community, Huntrule Team
references:
  - https://www.microsoft.com/en-us/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_susp_exfil_and_tunneling_tool_execution.yml
date: 2019-10-24
modified: 2024-01-18
tags:
  - attack.exfiltration
  - attack.command-and-control
  - attack.t1041
  - attack.t1572
  - attack.t1071.001
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - \httptunnel.exe
      - \plink.exe
      - \socat.exe
      - \stunnel.exe
  condition: selection
falsepositives:
  - Legitimate administrators using one of these tools
level: medium
license: DRL-1.1
related:
  - id: c75309a3-59f8-4a8d-9c2c-4c927ad50555
    type: derived