Windows Process Execution of Fast Reverse Proxy (FRP) frpc.exe or frps.exe

Alerts on Windows execution of FRP components (frpc.exe/frps.exe) with FRP indicators via command line or known hashes.

FreeUnreviewedSigmahighv1

windows-process-execution-of-fast-reverse-proxy-frp-frpc-exe-or-frps-exe-32410e29

title: Windows Process Execution of Fast Reverse Proxy (FRP) frpc.exe or frps.exe
id: 8c2bb1ef-0268-4612-8f3e-d7ecbfe1cd6a
status: test
description: This rule flags Windows process creation where the executable name ends with frpc.exe or frps.exe, and where command-line activity indicates FRP configuration usage or specific known binary hashes. Fast reverse proxies like FRP can be used by attackers to expose internal services and support command-and-control or lateral access paths through NAT/firewalls. It relies on process creation telemetry, including executable path endings, command-line content, and (when available) file hash values.
references:
  - https://asec.ahnlab.com/en/38156/
  - https://github.com/fatedier/frp
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_frp.yml
author: frack113, Florian Roth, Huntrule Team
date: 2022-09-02
modified: 2024-11-23
tags:
  - attack.command-and-control
  - attack.t1090
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - \frpc.exe
      - \frps.exe
  selection_cli:
    CommandLine|contains: \frpc.ini
  selection_hashes:
    Hashes|contains:
      - MD5=7D9C233B8C9E3F0EA290D2B84593C842
      - SHA1=06DDC9280E1F1810677935A2477012960905942F
      - SHA256=57B0936B8D336D8E981C169466A15A5FD21A7D5A2C7DAF62D5E142EE860E387C
  condition: 1 of selection_*
falsepositives:
  - Legitimate use
level: high
license: DRL-1.1
related:
  - id: 32410e29-5f94-4568-b6a3-d91a8adad863
    type: derived

What it detects

This rule flags Windows process creation where the executable name ends with frpc.exe or frps.exe, and where command-line activity indicates FRP configuration usage or specific known binary hashes. Fast reverse proxies like FRP can be used by attackers to expose internal services and support command-and-control or lateral access paths through NAT/firewalls. It relies on process creation telemetry, including executable path endings, command-line content, and (when available) file hash values.

Known false positives

Legitimate use

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.