LoFP / socat is a dual-use tool that can be used for benign or malicious activity. some normal use of this program, at varying levels of frequency, may originate from scripts, automation tools, and frameworks. usage by web servers is more likely to be suspicious.

Techniques

Sample rules

Socat Process Activity

• source: elastic
• technicques:

Description

A Socat process is running on a Linux host. Socat is often used as a persistence mechanism by exporting a reverse shell, or by serving a shell on a listening port. Socat is also sometimes used for lateral movement.

Detection logic

event.category:process and event.type:(start or process_started) and process.name:socat and not process.args:-V