Socat Process Activity

A Socat process is running on a Linux host. Socat is often used as a persistence mechanism by exporting a reverse shell, or by serving a shell on a listening port. Socat is also sometimes used for lateral movement.

Rule type: query
Rule indices:

• auditbeat-*
• logs-endpoint.events.*

Rule Severity: medium
Risk Score: 47
Runs every:
Searches indices from: now-9m
Maximum alerts per execution: 100
References:

• https://blog.ropnop.com/upgrading-simple-shells-to-fully-interactive-ttys/#method-2-using-socat

Tags:

• Elastic
• Host
• Linux
• Threat Detection

Version: 100
Rule authors:

• Elastic

Rule license: Elastic License v2

event.category:process and event.type:(start or process_started) and process.name:socat and not process.args:-V