Connection Proxy

Title: Connection Proxy
Status: test
Description:Detects setting proxy configuration
References:
Author: Ömer Günal
Date: 2020-06-17
modified:2022-10-05
Tags:

• -'attack.command-and-control'
• -'attack.t1090'

Logsource:

• product: linux
• category: process_creation

Detection:
  selection:
    CommandLine|contains:
      -'http_proxy='
      -'https_proxy='

  condition:selection
Falsepositives:
  -Legitimate administration activities
Level: low