LoFP LoFP / developers, network engineers, and system administrators may use socat to expose benign executables for protocol testing, debugging, data transformation, or troubleshooting.

Techniques

Sample rules

Socat Network Listener Binding an Executable

Description

The following analytic detects the execution of the socat utility with command-line arguments that configure a TCP or OpenSSL listener and bind an executable to incoming connections. Socat is a legitimate network utility, but this behavior may be used to expose executables, establish bind shells, facilitate remote command execution, or support lateral movement.

Detection logic


| tstats `security_content_summariesonly`
  count
  min(_time) as firstTime
  max(_time) as lastTime

from datamodel=Endpoint.Processes where

Processes.process_name="socat*"
Processes.process="*exec:*"
Processes.process="*-listen:*"

by Processes.dest Processes.original_file_name Processes.parent_process_id
   Processes.process Processes.process_exec Processes.process_guid
   Processes.process_hash Processes.process_id
   Processes.process_current_directory Processes.process_name
   Processes.process_path Processes.user
   Processes.user_id Processes.vendor_product


| `drop_dm_object_name(Processes)`

| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `socat_network_listener_binding_an_executable_filter`