| elastic |
Connection to Commonly Abused Web Services |
production |
2026-10-19 |
| splunk |
Windows Ngrok Reverse Proxy Usage |
production |
2026-10-09 |
| elastic |
IPv4/IPv6 Forwarding Activity |
production |
2026-10-09 |
| elastic |
Port Forwarding Rule Addition |
production |
2026-10-06 |
| elastic |
Potential SSH Reverse Port Forwarding |
production |
2026-09-18 |
| elastic |
Potential Protocol Tunneling via EarthWorm |
production |
2026-09-18 |
| elastic |
Potential Linux Tunneling and/or Port Forwarding via Command Line |
production |
2026-09-18 |
| elastic |
Potential Linux Tunneling and/or Port Forwarding via SSH Option |
production |
2026-09-18 |
| elastic |
Potential Linux Tunneling and/or Port Forwarding |
production |
2026-09-18 |
| elastic |
Suspicious Utility Launched via ProxyChains |
production |
2026-09-18 |
| elastic |
ProxyChains Activity |
production |
2026-09-18 |
| elastic |
Potential Protocol Tunneling via Chisel Client |
production |
2026-09-18 |
| elastic |
Unusual DNS Request to Suspicious Top Level Domain |
production |
2026-09-18 |
| elastic |
Curl SOCKS Proxy Activity from Unusual Parent |
production |
2026-09-18 |
| elastic |
Tunneling and/or Port Forwarding Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Curl SOCKS Proxy Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Potential Tunneling via Tailscaled |
production |
2026-09-18 |
| elastic |
Potential Traffic Tunneling using QEMU |
production |
2026-09-18 |
| elastic |
FortiGate SOCKS Traffic from an Unusual Process |
production |
2026-09-18 |
| elastic |
Kubectl Network Configuration Modification |
production |
2026-09-18 |
| elastic |
Potential Tunneling via AWS IoT Secure Tunneling Localproxy |
production |
2026-09-18 |
| elastic |
Potential Protocol Tunneling via Yuze |
production |
2026-09-18 |
| elastic |
Potential Protocol Tunneling via Cloudflared |
production |
2026-09-18 |
| splunk |
Linux Proxy Socks Curl |
production |
2026-06-04 |
| splunk |
Cisco IOS XE Tunnel Interface Configuration |
production |
2026-05-20 |
| splunk |
Windows Devtunnels Image Loaded |
production |
2026-05-13 |
| splunk |
Linux Ngrok Reverse Proxy Usage |
production |
2026-05-13 |
| splunk |
Okta Non-Standard VPN Usage |
experimental |
2026-05-13 |
| splunk |
Windows Devtunnels Execution |
production |
2026-05-13 |
| splunk |
Ngrok Reverse Proxy on Network |
production |
2026-05-13 |
| suricata |
ET MALWARE upStage Proxy Heartbeat |
rev 1 |
2026-02-11 |
| snort |
ET TROJAN upStage Proxy Heartbeat |
rev 1 |
2026-02-11 |
| snort |
ET TROJAN HTran/SensLiceld.A response to infected host - Inbound Connection Attempt |
rev 7 |
2025-02-21 |
| suricata |
ET MALWARE HTran/SensLiceld.A response to infected host - Inbound Connection Attempt |
rev 9 |
2025-02-21 |
| suricata |
ET MALWARE HTran/SensLiceld.A response to infected host - Outbound Connection Attempt |
rev 1 |
2025-02-21 |
| snort |
ET TROJAN HTran/SensLiceld.A response to infected host - Outbound Connection Attempt |
rev 1 |
2025-02-21 |
| sigma |
Kalambur Backdoor Curl TOR SOCKS Proxy Execution |
experimental |
2025-02-11 |
| sigma |
PUA - NPS Tunneling Tool Execution |
test |
2024-11-23 |
| sigma |
PUA- IOX Tunneling Tool Execution |
test |
2024-11-23 |
| sigma |
PUA - Fast Reverse Proxy (FRP) Execution |
test |
2024-11-23 |
| sigma |
Communication To LocaltoNet Tunneling Service Initiated - Linux |
test |
2024-06-17 |
| sigma |
Communication To LocaltoNet Tunneling Service Initiated |
test |
2024-06-17 |
| sigma |
Potentially Suspicious Usage Of Qemu |
test |
2024-06-03 |
| sigma |
New PortProxy Registry Entry Added |
test |
2024-03-25 |
| sigma |
OpenCanary - HTTPPROXY Login Attempt |
test |
2024-03-08 |
| sigma |
Communication To Ngrok Tunneling Service Initiated |
test |
2024-02-02 |
| sigma |
Cloudflared Tunnel Connections Cleanup |
test |
2023-12-21 |
| sigma |
Cloudflared Tunnel Execution |
test |
2023-12-20 |
| sigma |
Malicious IP Address Sign-In Suspicious |
test |
2023-09-07 |
| sigma |
Malicious IP Address Sign-In Failure Rate |
test |
2023-09-07 |
| sigma |
Sign-In From Malware Infected IP |
test |
2023-09-03 |
| sigma |
New Port Forwarding Rule Added Via Netsh.EXE |
test |
2023-09-01 |
| sigma |
RDP Port Forwarding Rule Added Via Netsh.EXE |
test |
2023-02-13 |
| sigma |
HackTool - Htran/NATBypass Execution |
test |
2023-02-04 |
| sigma |
Communication To Ngrok Tunneling Service - Linux |
test |
2022-11-03 |
| sigma |
Connection Proxy |
test |
2022-10-05 |
| sigma |
Suspicious TCP Tunnel Via PowerShell Script |
test |
2022-07-08 |
| sigma |
Ngrok Usage with Remote Desktop Service |
test |
2022-04-29 |
| elastic |
Tor Activity to the Internet |
deprecated |
2021-04-15 |
| suricata |
ET MALWARE Win32/ElectricFish Authentication Packet Observed |
rev 2 |
2019-07-26 |
| snort |
ET TROJAN Win32/ElectricFish Authentication Packet Observed |
rev 2 |
2019-05-09 |