PUA - 3Proxy Execution

Title: PUA - 3Proxy Execution
Status: test
Description:Detects the use of 3proxy, a tiny free proxy server
References:
  -https://github.com/3proxy/3proxy
  -https://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
Author: Florian Roth (Nextron Systems)
Date: 2022-09-13
modified:2023-02-21
Tags:

• -'attack.command-and-control'
• -'attack.t1572'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
    Image|endswith: '\3proxy.exe'
  selection_pe:
    Description: '3proxy - tiny proxy server'
  selection_params:
    CommandLine|contains: '.exe -i127.0.0.1 -p'
  condition:1 of selection_*
Falsepositives:
  -Administrative activity
Level: high