PUA- IOX Tunneling Tool Execution

Title: PUA- IOX Tunneling Tool Execution
Status: test
Description:Detects the use of IOX - a tool for port forwarding and intranet proxy purposes
References:
  -https://github.com/EddieIvan01/iox
Author: Florian Roth (Nextron Systems)
Date: 2022-10-08
modified:2024-11-23
Tags:

• -'attack.command-and-control'
• -'attack.t1090'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Image|endswith: '\iox.exe'
  selection_commandline:
    CommandLine|contains:
      -'.exe fwd -l '
      -'.exe fwd -r '
      -'.exe proxy -l '
      -'.exe proxy -r '

  selection_hashes:
    Hashes|contains:
      -'MD5=9DB2D314DD3F704A02051EF5EA210993'
      -'SHA1=039130337E28A6623ECF9A0A3DA7D92C5964D8DD'
      -'SHA256=C6CF82919B809967D9D90EA73772A8AA1C1EB3BC59252D977500F64F1A0D6731'

  condition:1 of selection*
Falsepositives:
  -Legitimate use
Level: high