Techniques
Sample rules
Socat Remote TCP Connection with Local Echo Disabled
- source: splunk
- technicques:
Description
The following analytic detects execution of the socat utility with a remote TCP or OpenSSL connection and local terminal echo disabled. This configuration may be used for interactive terminal sessions, password handling, automation, or network debugging. When observed in an unexpected context, such as execution by an unusual parent process or connection to an untrusted endpoint, it may indicate suspicious remote access activity.
Detection logic
| tstats `security_content_summariesonly`
count min(_time) as firstTime
max(_time) as lastTime
from datamodel=Endpoint.Processes where
Processes.process_name="socat*"
Processes.process="*echo=0*"
Processes.process IN (
"*openssl:*",
"*tcp:*",
"*tcp4:*",
"*tcp6:*"
)
by Processes.dest Processes.original_file_name Processes.parent_process_id
Processes.process Processes.process_exec Processes.process_guid
Processes.process_hash Processes.process_id
Processes.process_current_directory Processes.process_name
Processes.process_path Processes.user
Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `socat_remote_tcp_connection_with_local_echo_disabled_filter`