Port-relay tool invoked with a listener or SOCKS address

Siemphony@siemphonymediumT1090unverified

Matches a socat or ncat process started with an address or flag that only makes sense when the tool is bridging two connections, which is the executable half of MITRE's AN1230. The analytic pairs the tool with an uncommon outbound destination; the destination is a second event, so this rule keeps the part a single execve record can carry and gates the tool list against a relay-shaped argument rather than alerting on every invocation. MITRE's CommandLinePattern knob names socat, ncat and openssl; the address keywords listed here are authored from those tools' own syntax. The analytic also names ssh and iptables, which are left out on purpose: their forwarding flags are single letters that collide with routine administration, and a rule keyed on them would be noise rather than detection. Bare nc is left out for a different reason — Debian and Ubuntu route it through the alternatives system, so the binary auditd records is nc.openbsd or nc.traditional and an endswith on '/nc' would silently never fire. Prerequisite: auditd ships no execve rule by default, so without an explicit -a always,exit -F arch=b64 -S execve there is no process_creation telemetry on the host at all and this rule returns zero rows regardless of what ran. CommandLine is reconstructed from the a0..aN fields, and auditd hex-encodes any single argument containing whitespace; the keywords here appear inside whitespace-free arguments, so they survive that encoding, but a keyword added later might not. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0445, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "/socat" or FolderPath endswith "/ncat") and (ProcessCommandLine contains "TCP-LISTEN" or ProcessCommandLine contains "TCP4-LISTEN" or ProcessCommandLine contains "TCP6-LISTEN" or ProcessCommandLine contains "UDP-LISTEN" or ProcessCommandLine contains "OPENSSL-LISTEN" or ProcessCommandLine contains "SOCKS4" or ProcessCommandLine contains "SOCKS5" or ProcessCommandLine contains "PROXY:" or ProcessCommandLine contains "--proxy" or ProcessCommandLine contains "--broker"))

Splunk · SPL

Run this as a search.

index=* ((Image="*/socat" OR Image="*/ncat") AND (CommandLine="*TCP-LISTEN*" OR CommandLine="*TCP4-LISTEN*" OR CommandLine="*TCP6-LISTEN*" OR CommandLine="*UDP-LISTEN*" OR CommandLine="*OPENSSL-LISTEN*" OR CommandLine="*SOCKS4*" OR CommandLine="*SOCKS5*" OR CommandLine="*PROXY:*" OR CommandLine="*--proxy*" OR CommandLine="*--broker*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*/socat" OR TO_LOWER(process.executable) LIKE "*/ncat") AND (TO_LOWER(process.command_line) LIKE "*tcp-listen*" OR TO_LOWER(process.command_line) LIKE "*tcp4-listen*" OR TO_LOWER(process.command_line) LIKE "*tcp6-listen*" OR TO_LOWER(process.command_line) LIKE "*udp-listen*" OR TO_LOWER(process.command_line) LIKE "*openssl-listen*" OR TO_LOWER(process.command_line) LIKE "*socks4*" OR TO_LOWER(process.command_line) LIKE "*socks5*" OR TO_LOWER(process.command_line) LIKE "*proxy:*" OR TO_LOWER(process.command_line) LIKE "*--proxy*" OR TO_LOWER(process.command_line) LIKE "*--broker*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(/socat$|/ncat$)</field>    <field name="CommandLine" type="pcre2">(?i)(TCP-LISTEN|TCP4-LISTEN|TCP6-LISTEN|UDP-LISTEN|OPENSSL-LISTEN|SOCKS4|SOCKS5|PROXY:|--proxy|--broker)</field>    <description>Port-relay tool invoked with a listener or SOCKS address</description>    <mitre>      <id>T1090</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / linux
Level: medium
Category: reverse_shell
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: b6c49897-9d56-45ee-a096-5eaa8c8fc76e

ATT&CKT1090

T1090Proxy

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonreverse shell

reverse shellAI draft — unreviewed

01 · What this rule detects

A socat or ncat process started with an argument that only makes sense when the tool is bridging two connections — a listener address, a SOCKS address, a proxy flag. The tool alone is not the signal; plenty of hosts have socat installed for good reasons. The pairing of tool and relay-shaped argument is.

02 · Telemetry you need

Linux process_creation from auditd `execve`. auditd ships **no execve
CommandLine reconstructed from the a0..aN fields. auditd hex-encodes any

03 · How the logic works

What MITRE gave and what the author added. AN1230's CommandLinePattern knob names socat, ncat and openssl. The ten address keywords are authored from those tools' syntax, not MITRE's. openssl was named by MITRE and silently dropped — OPENSSL-LISTEN here is a socat address type, not the openssl binary, and is easy to misread as coverage of openssl s_server. Two exclusions that are well-reasoned. ssh and iptables forwarding flags are single letters that collide with routine administration. Bare nc is left out because Debian and Ubuntu route it through the alternatives system — auditd records nc.openbsd or nc.traditional, so Image|endswith: '/nc' would silently never fire. That is the dead-selector class this corpus keeps paying for: validates clean, renders everywhere, matches nothing. The hole the reviewer found, and the lesson in it. socat accepts abbreviated address keywords. socat TCP-L:443,fork TCP:redirector:443 is a working redirector containing none of the ten strings — TCP-L: is not TCP-LISTEN. Same for TCP4-L, TCP6-L, UDP-L. This is not a trick an operator has to invent; many published socat one-liners are already written that way, so it is a coverage hole before it is a bypass. The fix is instructive because it is smaller than the original: match the stem TCP-L and it subsumes both forms, since TCP-LISTEN contains TCP-L. Use the shortest string that is still specific — a longer literal is not a tighter rule, only a narrower one. The arms are lopsided. Only --proxy and --broker can ever match ncat, so its listener forms — ncat -l 4444 --sh-exec /bin/bash, -lk 1080 -e /bin/sh, --keep-open — produce nothing, and an ncat listener as the inbound half of a relay is invisible. The relay keywords are also ORed against the tool list rather than bound to a tool, so LISTEN terms get evaluated against ncat: loose rather than wrong, but any keyword added for one tool applies to both.

04 · Common false positives

Kubernetes port-forwarding, which has historically shelled out to socat
Container and CI tooling using socat as a deliberate relay into another
ncat as an SSH `ProxyCommand` in a corporate ssh_config — the reviewer's

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0445 and never executed against a log line. level: medium is a judgement for a mixed estate; on a Kubernetes node class the rule as shipped is unusable, and nothing in the level signals that.
tier_2: turn on the execve audit rule, baseline socat per host class, encode the kubelet exclusion.
tier_3: restores what AN1230 asked for — the execution joined to the uncommon outbound destination it created, over MITRE's OutboundPortRange: a second log source and a correlation Sigma cannot carry.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

`ProcessUserContext` (MITRE's knob) is the intended narrowing: restrict to
Ship the kubelet-parent exclusion as a real filter block. The rule's own false
Renaming or copying the binary defeats the Image gate as cheaply as the

Declared by the author

Kubernetes port-forwarding, which has historically shelled out to socat with a TCP4-LISTEN address for every forwarded port. On a worker node this fires continuously and drowns the rule, so cluster nodes need the kubelet parent excluded before the rule is usable at all.
Container and CI tooling that uses socat as a deliberate TCP relay to reach a service inside another network namespace, for example a health check or a database tunnel in a build job. These runs look exactly like a proxy because they are one.
An administrator reaching a host through a jump box with ncat --proxy during troubleshooting, or standing up a temporary socat relay to test a firewall change. MITRE's ProcessUserContext knob is where this narrows, by restricting the rule to accounts that have no operational reason to relay traffic.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1090, evaluated against their process_creation events.

Share this rule

/u/siemphony/b6c49897-9d56-45ee-a096-5eaa8c8fc76e

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Port-relay tool invoked with a listener or SOCKS address

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it