Windows Process Execution of Fast Reverse Proxy (FRP) frpc.exe or frps.exe

ATT&CK techniques

C2

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1090Proxy
Exfiltration
Impact

What it detects

This rule flags Windows process creation where the executable name ends with frpc.exe or frps.exe, and where command-line activity indicates FRP configuration usage or specific known binary hashes. Fast reverse proxies like FRP can be used by attackers to expose internal services and support command-and-control or lateral access paths through NAT/firewalls. It relies on process creation telemetry, including executable path endings, command-line content, and (when available) file hash values.

Reporting behind it

Related detections9 linkedT1090 — drag to rearrange

Suspicious Flax Typhoon System Utility Masquerade Outside System32 via Renamed VPN Client (via process_creation)

Possible Credential Stuffing Blocked by Conditional Access in Microsoft 365

Possible ReverseSocks5 Tunneling Tool Execution on Linux (via process_creation)

Malicious GhostSocks Loader Execution with johnpidar Argument via process_creation

Malicious Chisel Reverse SOCKS Proxy Execution (via process_creation)

Malicious QEMU Covert Network Tunnel via User-Mode netdev Socket (via process_creation)

Malicious Tunneling Tool Execution on Linux Host (via process_creation)

Suspicious Chisel Reverse Tunnel Execution by UAT-9686

Suspicious macOS Trojan-Proxy LaunchAgent GoogleHelperUpdater Persistence (via file_event)

Windows Process Execution of Fast Reverse Proxy (FRP) frpc.exe or frps.exe

Pivot detection · T1090 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-execution-of-fast-reverse-proxy-frp-frpc-exe-or-frps-exe-32410e29

title: Windows Process Execution of Fast Reverse Proxy (FRP) frpc.exe or frps.exe
id: 8c2bb1ef-0268-4612-8f3e-d7ecbfe1cd6a
status: test
description: This rule flags Windows process creation where the executable name ends with frpc.exe or frps.exe, and where command-line activity indicates FRP configuration usage or specific known binary hashes. Fast reverse proxies like FRP can be used by attackers to expose internal services and support command-and-control or lateral access paths through NAT/firewalls. It relies on process creation telemetry, including executable path endings, command-line content, and (when available) file hash values.
references:
  - https://asec.ahnlab.com/en/38156/
  - https://github.com/fatedier/frp
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_frp.yml
author: frack113, Florian Roth, Huntrule Team
date: 2022-09-02
modified: 2024-11-23
tags:
  - attack.command-and-control
  - attack.t1090
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - \frpc.exe
      - \frps.exe
  selection_cli:
    CommandLine|contains: \frpc.ini
  selection_hashes:
    Hashes|contains:
      - MD5=7D9C233B8C9E3F0EA290D2B84593C842
      - SHA1=06DDC9280E1F1810677935A2477012960905942F
      - SHA256=57B0936B8D336D8E981C169466A15A5FD21A7D5A2C7DAF62D5E142EE860E387C
  condition: 1 of selection_*
falsepositives:
  - Legitimate use
level: high
license: DRL-1.1
related:
  - id: 32410e29-5f94-4568-b6a3-d91a8adad863
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL