Potential Network Traffic Tunneling via Proxychains

[rule]
description = """
This rule identifies the use of proxychains to potentially tunnel network traffic. Attackers can leverage proxychains to
establish hidden communication channels and gain unauthorized access to internal resources, facilitating data
exfiltration or lateral movement via proxychains while evading direct connection blocking.
"""
id = "4484d4b4-499f-4c8e-aa32-be7c0d66eb6c"
license = "Elastic License v2"
name = "Potential Network Traffic Tunneling via Proxychains"
os_list = ["linux"]
reference = [
    "https://book.hacktricks.xyz/generic-methodologies-and-resources/tunneling-and-port-forwarding",
    "https://github.com/haad/proxychains",
]
version = "1.0.1"

query = '''
process where event.type == "start" and event.action == "exec" and process.name in ("proxychains", "proxychains4", "proxyresolv")
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1572"
name = "Protocol Tunneling"
reference = "https://attack.mitre.org/techniques/T1572/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"