PUA - 3Proxy Execution

About the rule

Rule Type

Standard

Rule Description

Detects the use of 3proxy, a small free proxy server, which can be exploited by adversaries for protocol tunneling to facilitate covert command and control communications.

Severity

Trouble

Rule journey

Attack chain scenario

Command and Control: Protocol Tunneling (T1572)

Impact

Enables attackers to tunnel malicious traffic through proxy services, aiding in stealthy communication, data exfiltration, and lateral movement.

Rule Requirement

Prerequisites

Process Creation Auditing

Using Windows Event Viewer

1. Log in to a domain controller with domain admin credentials.
2. Open Group Policy Management Console (GPMC) by typing gpmc.msc in the Run dialog.
3. Create a new GPO or edit an existing one linked to the appropriate OU.
4. Navigate to:
   Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Audit Policies → Detailed Tracking
5. Right-click Audit Process Creation → Select Properties
6. Choose Configure the following audit events → Check Success → Click OK
7. Right-click Audit Process Termination → Select Properties
8. Choose Configure the following audit events → Check Success → Click OK
9. For enhanced tracking with command-line data:
   • Go to Computer Configuration → Administrative Templates → System → Audit Process Creation
   • Double-click Include command line in process creation events
   • Select Enabled → Click OK
10. Create the registry key:
    Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Microsoft-Windows-Security-Auditing\Operational

Using Sysmon

1. Download and install Sysmon from Microsoft Sysinternals
2. Open Command Prompt with administrator privileges
3. Create or download a Sysmon configuration file that includes process creation monitoring
4. Install Sysmon using:
   sysmon.exe -i [configfile.xml]
5. Sample configuration to monitor process creation:
6. xml
7. CopyEdit
8. <Sysmon>
   <EventFiltering>
   <ProcessCreate onmatch="exclude"/>
   <!-- This captures all process creations -->
   </EventFiltering>
   </Sysmon>
9. Create the registry key:
   Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Microsoft-Windows-Sysmon\Operational

Criteria

Detection

Execution Mode

realtime

Log Sources

Windows

MITRE ATT&CK

T1572: Protocol Tunneling

Security Standards

1. Filter network traffic to block connections to untrusted or malicious domains and IP addresses.
2. Deploy intrusion detection and prevention systems with signatures targeting adversary proxy and tunneling activities.

Author

Florian Roth (Nextron Systems)

Future actions

Known False Positives

Potential for legitimate use during authorized proxy server testing or administration.

Next Steps

• Investigate instances of 3proxy execution or suspicious command line patterns.
• Verify authorized use or presence of malicious activity.
• Implement network and endpoint monitoring to detect and halt proxy tunneling.
• Train security teams on proxy tunneling attack methods and mitigation.

Mitigation