Security & Threat Intelligence · 25.07.2026, 15:29 UTC
Finding SOCKS with Proxywatch
| Schweregrad | info |
|---|---|
| Kategorie | Security & Threat Intelligence |
| Quelle | SpecterOps ↗ |
| Veröffentlicht | 25.07.2026 UTC |
Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.
TL;DR: Adversaries use SOCKS proxy tunnels to pivot within environments and to execute code against compromised systems without bringing tools to the system. Defenders often lack reliable guidance to detect proxying behavior, falling back to preset rules based on static indicators or process-port baselines. This blog post highlights Proxywatch, a proof-of-concept release by SpecterOps, to detect SOCKS proxies and other pivoting methods through behavior-based detection.
Overview
When considering detections as a defender, it often helps to think from an attacker’s perspective and the choices they make (or are forced to make) in their tradecraft. The tactics, techniques, and procedures (TTPs) that attackers use are typically shaped by what actually works and change if effective security controls prevent or detect their previously working tools. As network perimeters harden and endpoint detection and response (EDR) tools improve, one technique that attackers use instead is the proxy pivot. After compromising a host, attackers use its presence inside of a network as an exit node, routing traffic from tools run on the attacker’s machine onto the victim network, often avoiding detection from EDR.
The SOCKS protocol describes a standard for network communication between a client and a server via an intermediary proxy server. Command and control (C2) tools like Cobalt Strike, Mythic, and Sliver all implement functionality to turn an agent (i.e., a compromised victim machine) into a SOCKS proxy. After enabling SOCKS, an attacker can use proxychains to run nearly any tool, even …