From f6de1d4d9b29477f75465e7cffe891beaa3a7c4f Mon Sep 17 00:00:00 2001 From: merquiag Date: Tue, 1 Sep 2026 13:01:44 +0200 Subject: [PATCH 1/4] Add socat utility detections --- ...at_utility_listener_binding_executable.yml | 95 +++++++++++++++++++ ...mote_tcp_connection_with_echo_disabled.yml | 90 ++++++++++++++++++ 2 files changed, 185 insertions(+) create mode 100644 detections/endpoint/socat_utility_listener_binding_executable.yml create mode 100644 detections/endpoint/socat_utility_remote_tcp_connection_with_echo_disabled.yml diff --git a/detections/endpoint/socat_utility_listener_binding_executable.yml b/detections/endpoint/socat_utility_listener_binding_executable.yml new file mode 100644 index 0000000000..f500b0992d --- /dev/null +++ b/detections/endpoint/socat_utility_listener_binding_executable.yml @@ -0,0 +1,95 @@ +name: Socat Utility Listener Binding Executable +id: 72482d45-1d05-46f5-bb6c-e2b709a8073a +version: 1 +creation_date: '2026-08-27' +modification_date: '2026-08-27' +author: Maria Jose Erquiaga, Splunk +status: production +type: TTP +description: |- + Detects the execution of the socat utility with command-line arguments that configure a TCP or OpenSSL listener and bind an executable to incoming connections. Socat is a legitimate network utility, but this behavior may be used to expose executables, establish bind shells, facilitate remote command execution, or support lateral movement. +data_source: + - Osquery Results +search: |- + | tstats `security_content_summariesonly` + count + min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.process_path="*/socat*" + AND Processes.process="*exec:*" + AND Processes.process="*-listen:*" + AND ( + Processes.process="*openssl-listen:*" + OR Processes.process="*tcp-listen:*" + OR Processes.process="*tcp4-listen:*" + OR Processes.process="*tcp6-listen:*" + ) + + by Processes.dest Processes.original_file_name Processes.parent_process_id + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_current_directory Processes.process_name + Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `socat_utility_listener_binding_executable_filter` +how_to_implement: |- + This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. + Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: |- + Authorized penetration testing or red team exercises may use socat TCP listeners to validate security controls in lab environments. + Developers, network engineers, and system administrators may use socat to expose benign executables for protocol testing, debugging, data transformation, or troubleshooting. +references: + - https://attack.mitre.org/tactics/TA0002/ + - https://attack.mitre.org/techniques/T1059 + - https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/ + - https://gtfobins.github.io/gtfobins/socat/ + - https://hackers-arise.com/socat-the-advanced-hackers-network-tool/ +drilldown_searches: + - name: View the detection results for - "$user$" and "$host$" + search: '%original_detection_search% | search user="$user$" host="$host$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$host$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$host$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: Socat was executed on endpoint $dest$ by user $user$ with a network listener binding an executable via $process$. + entity: + field: dest + type: system + score: 50 +intermediate_findings: + entities: + - field: user + type: user + score: 50 + message: Socat was executed on endpoint $dest$ by user $user$ with a network listener binding an executable via $process$. +threat_objects: + - field: process + type: process +analytic_story: + - MacOS Post-Exploitation +asset_type: Endpoint +mitre_attack_id: + - T1059 +product: + - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/utility_socat_listener_binding_executable/osquery.log + source: osqueryd.results.log + sourcetype: osquery:results + test_type: unit diff --git a/detections/endpoint/socat_utility_remote_tcp_connection_with_echo_disabled.yml b/detections/endpoint/socat_utility_remote_tcp_connection_with_echo_disabled.yml new file mode 100644 index 0000000000..cadac96227 --- /dev/null +++ b/detections/endpoint/socat_utility_remote_tcp_connection_with_echo_disabled.yml @@ -0,0 +1,90 @@ +name: Socat Utility Remote TCP Connection with Echo Disabled +id: 458c6c37-116d-4f01-8267-f09f5b82cd14 +version: 1 +creation_date: '2026-08-27' +modification_date: '2026-08-27' +author: Maria Jose Erquiaga, Splunk +status: production +type: TTP +description: |- + Detects the execution of the socat utility on a MacOS endpoint with command-line arguments that connect to a remote TCP endpoint while disabling local terminal echo. Socat can be used legitimately for network debugging, but this behavior may also support remote command execution, bind-shell access, or lateral movement. +data_source: + - Osquery Results +search: |- + | tstats `security_content_summariesonly` + count + min(_time) as firstTime + max(_time) as lastTime + from datamodel=Endpoint.Processes where + Processes.process_path="*/socat*" + AND Processes.process="*echo=0*" + AND ( + Processes.process="*openssl:*" + OR Processes.process="*tcp:*" + OR Processes.process="*tcp4:*" + OR Processes.process="*tcp6:*" + ) + by Processes.dest Processes.original_file_name Processes.parent_process_id + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_current_directory Processes.process_name + Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `socat_utility_remote_tcp_connection_with_echo_disabled_filter` +how_to_implement: |- + This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. + Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: |- + Authorized penetration testing or red team exercises may use socat to connect to controlled TCP listeners or test bind-shell detections. + Developers and network engineers may use socat with local echo disabled for legitimate TCP debugging, protocol testing, terminal handling, or troubleshooting. +references: + - https://attack.mitre.org/tactics/TA0002/ + - https://attack.mitre.org/techniques/T1059 + - https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/ + - https://gtfobins.github.io/gtfobins/socat/ + - https://hackers-arise.com/socat-the-advanced-hackers-network-tool/ +drilldown_searches: + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user="$user$" dest="$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: User $user$ executed socat on endpoint $dest$ with arguments configured to connect to a remote TCP or OpenSSL endpoint with local echo disabled via $process$. + entity: + field: dest + type: system + score: 50 +intermediate_findings: + entities: + - field: user + type: user + score: 50 + message: Socat was executed on endpoint $dest$ by user $user$ with arguments configured to connect to a remote TCP or OpenSSL endpoint with local echo disabled via $process$. +threat_objects: + - field: process + type: process +analytic_story: + - MacOS Post-Exploitation +asset_type: Endpoint +mitre_attack_id: + - T1059 +product: + - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/utility_socat_remote_tcp_connection_with_echo_disabled/osquery.log + source: osquery + sourcetype: osquery:results + test_type: unit From a7039c120df6e3f8aaed20aabf22e642916bbaa9 Mon Sep 17 00:00:00 2001 From: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> Date: Tue, 1 Sep 2026 13:29:21 +0200 Subject: [PATCH 2/4] Update socat_utility_listener_binding_executable.yml --- .../endpoint/socat_utility_listener_binding_executable.yml | 6 ------ 1 file changed, 6 deletions(-) diff --git a/detections/endpoint/socat_utility_listener_binding_executable.yml b/detections/endpoint/socat_utility_listener_binding_executable.yml index f500b0992d..3f2ad7e65c 100644 --- a/detections/endpoint/socat_utility_listener_binding_executable.yml +++ b/detections/endpoint/socat_utility_listener_binding_executable.yml @@ -21,12 +21,6 @@ search: |- Processes.process_path="*/socat*" AND Processes.process="*exec:*" AND Processes.process="*-listen:*" - AND ( - Processes.process="*openssl-listen:*" - OR Processes.process="*tcp-listen:*" - OR Processes.process="*tcp4-listen:*" - OR Processes.process="*tcp6-listen:*" - ) by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid From 07a0c7af21fa1ed941e1531191d8628006f9be8c Mon Sep 17 00:00:00 2001 From: oerdogan Date: Tue, 1 Sep 2026 16:32:54 +0200 Subject: [PATCH 3/4] minor fix on process name --- .../endpoint/socat_utility_listener_binding_executable.yml | 2 +- .../socat_utility_remote_tcp_connection_with_echo_disabled.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/socat_utility_listener_binding_executable.yml b/detections/endpoint/socat_utility_listener_binding_executable.yml index 3f2ad7e65c..55db4ffcba 100644 --- a/detections/endpoint/socat_utility_listener_binding_executable.yml +++ b/detections/endpoint/socat_utility_listener_binding_executable.yml @@ -18,7 +18,7 @@ search: |- from datamodel=Endpoint.Processes where - Processes.process_path="*/socat*" + Processes.process_name="socat*" AND Processes.process="*exec:*" AND Processes.process="*-listen:*" diff --git a/detections/endpoint/socat_utility_remote_tcp_connection_with_echo_disabled.yml b/detections/endpoint/socat_utility_remote_tcp_connection_with_echo_disabled.yml index cadac96227..57277b72e9 100644 --- a/detections/endpoint/socat_utility_remote_tcp_connection_with_echo_disabled.yml +++ b/detections/endpoint/socat_utility_remote_tcp_connection_with_echo_disabled.yml @@ -16,7 +16,7 @@ search: |- min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where - Processes.process_path="*/socat*" + Processes.process_name="socat*" AND Processes.process="*echo=0*" AND ( Processes.process="*openssl:*" From c7c1b3dc129ec15b75f0e6f3f999e54cfa1e225a Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Mon, 7 Sep 2026 01:40:24 +0200 Subject: [PATCH 4/4] rename and slight metadata fixes --- ...etwork_listener_binding_an_executable.yml} | 28 +++++---- ...p_connection_with_local_echo_disabled.yml} | 60 +++++++++---------- 2 files changed, 45 insertions(+), 43 deletions(-) rename detections/endpoint/{socat_utility_listener_binding_executable.yml => socat_network_listener_binding_an_executable.yml} (63%) rename detections/endpoint/{socat_utility_remote_tcp_connection_with_echo_disabled.yml => socat_remote_tcp_connection_with_local_echo_disabled.yml} (55%) diff --git a/detections/endpoint/socat_utility_listener_binding_executable.yml b/detections/endpoint/socat_network_listener_binding_an_executable.yml similarity index 63% rename from detections/endpoint/socat_utility_listener_binding_executable.yml rename to detections/endpoint/socat_network_listener_binding_an_executable.yml index 55db4ffcba..2ff67a8fe4 100644 --- a/detections/endpoint/socat_utility_listener_binding_executable.yml +++ b/detections/endpoint/socat_network_listener_binding_an_executable.yml @@ -1,4 +1,4 @@ -name: Socat Utility Listener Binding Executable +name: Socat Network Listener Binding an Executable id: 72482d45-1d05-46f5-bb6c-e2b709a8073a version: 1 creation_date: '2026-08-27' @@ -7,9 +7,11 @@ author: Maria Jose Erquiaga, Splunk status: production type: TTP description: |- - Detects the execution of the socat utility with command-line arguments that configure a TCP or OpenSSL listener and bind an executable to incoming connections. Socat is a legitimate network utility, but this behavior may be used to expose executables, establish bind shells, facilitate remote command execution, or support lateral movement. + The following analytic detects the execution of the socat utility with command-line arguments that configure a TCP or OpenSSL listener and bind an executable to incoming connections. + Socat is a legitimate network utility, but this behavior may be used to expose executables, establish bind shells, facilitate remote command execution, or support lateral movement. data_source: - Osquery Results + - Sysmon for Linux EventID 1 search: |- | tstats `security_content_summariesonly` count @@ -18,9 +20,9 @@ search: |- from datamodel=Endpoint.Processes where - Processes.process_name="socat*" - AND Processes.process="*exec:*" - AND Processes.process="*-listen:*" + Processes.process_name="socat*" + Processes.process="*exec:*" + Processes.process="*-listen:*" by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid @@ -32,12 +34,11 @@ search: |- | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `socat_utility_listener_binding_executable_filter` + | `socat_network_listener_binding_an_executable_filter` how_to_implement: |- This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. known_false_positives: |- - Authorized penetration testing or red team exercises may use socat TCP listeners to validate security controls in lab environments. Developers, network engineers, and system administrators may use socat to expose benign executables for protocol testing, debugging, data transformation, or troubleshooting. references: - https://attack.mitre.org/tactics/TA0002/ @@ -46,16 +47,16 @@ references: - https://gtfobins.github.io/gtfobins/socat/ - https://hackers-arise.com/socat-the-advanced-hackers-network-tool/ drilldown_searches: - - name: View the detection results for - "$user$" and "$host$" - search: '%original_detection_search% | search user="$user$" host="$host$"' + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - - name: View risk events for the last 7 days for - "$user$" and "$host$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$host$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: 7d latest_offset: "0" finding: - title: Socat was executed on endpoint $dest$ by user $user$ with a network listener binding an executable via $process$. + title: Socat was executed with a TCP or OpenSSL listener configured to pass inbound connections to an executable via [$process$] on endpoint [$dest$] by user [$user$]. entity: field: dest type: system @@ -65,7 +66,7 @@ intermediate_findings: - field: user type: user score: 50 - message: Socat was executed on endpoint $dest$ by user $user$ with a network listener binding an executable via $process$. + message: Socat was executed with a TCP or OpenSSL listener configured to pass inbound connections to an executable via [$process$] on endpoint [$dest$] by user [$user$]. threat_objects: - field: process type: process @@ -74,6 +75,7 @@ analytic_story: asset_type: Endpoint mitre_attack_id: - T1059 + - T1572 product: - Splunk Cloud - Splunk Enterprise diff --git a/detections/endpoint/socat_utility_remote_tcp_connection_with_echo_disabled.yml b/detections/endpoint/socat_remote_tcp_connection_with_local_echo_disabled.yml similarity index 55% rename from detections/endpoint/socat_utility_remote_tcp_connection_with_echo_disabled.yml rename to detections/endpoint/socat_remote_tcp_connection_with_local_echo_disabled.yml index 57277b72e9..cc26421856 100644 --- a/detections/endpoint/socat_utility_remote_tcp_connection_with_echo_disabled.yml +++ b/detections/endpoint/socat_remote_tcp_connection_with_local_echo_disabled.yml @@ -1,44 +1,49 @@ -name: Socat Utility Remote TCP Connection with Echo Disabled +name: Socat Remote TCP Connection with Local Echo Disabled id: 458c6c37-116d-4f01-8267-f09f5b82cd14 version: 1 creation_date: '2026-08-27' modification_date: '2026-08-27' author: Maria Jose Erquiaga, Splunk status: production -type: TTP +type: Anomaly description: |- - Detects the execution of the socat utility on a MacOS endpoint with command-line arguments that connect to a remote TCP endpoint while disabling local terminal echo. Socat can be used legitimately for network debugging, but this behavior may also support remote command execution, bind-shell access, or lateral movement. + The following analytic detects execution of the socat utility with a remote TCP or OpenSSL connection and local terminal echo disabled. + This configuration may be used for interactive terminal sessions, password handling, automation, or network debugging. + When observed in an unexpected context, such as execution by an unusual parent process or connection to an untrusted endpoint, it may indicate suspicious remote access activity. data_source: - Osquery Results + - Sysmon for Linux EventID 1 search: |- | tstats `security_content_summariesonly` - count - min(_time) as firstTime - max(_time) as lastTime + count min(_time) as firstTime + max(_time) as lastTime + from datamodel=Endpoint.Processes where - Processes.process_name="socat*" - AND Processes.process="*echo=0*" - AND ( - Processes.process="*openssl:*" - OR Processes.process="*tcp:*" - OR Processes.process="*tcp4:*" - OR Processes.process="*tcp6:*" - ) + + Processes.process_name="socat*" + Processes.process="*echo=0*" + Processes.process IN ( + "*openssl:*", + "*tcp:*", + "*tcp4:*", + "*tcp6:*" + ) + by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `socat_utility_remote_tcp_connection_with_echo_disabled_filter` + | `socat_remote_tcp_connection_with_local_echo_disabled_filter` how_to_implement: |- This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. known_false_positives: |- - Authorized penetration testing or red team exercises may use socat to connect to controlled TCP listeners or test bind-shell detections. Developers and network engineers may use socat with local echo disabled for legitimate TCP debugging, protocol testing, terminal handling, or troubleshooting. references: - https://attack.mitre.org/tactics/TA0002/ @@ -47,26 +52,20 @@ references: - https://gtfobins.github.io/gtfobins/socat/ - https://hackers-arise.com/socat-the-advanced-hackers-network-tool/ drilldown_searches: - - name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user="$user$" dest="$dest$"' + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - - name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: 7d latest_offset: "0" -finding: - title: User $user$ executed socat on endpoint $dest$ with arguments configured to connect to a remote TCP or OpenSSL endpoint with local echo disabled via $process$. - entity: - field: dest - type: system - score: 50 intermediate_findings: entities: - - field: user - type: user - score: 50 - message: Socat was executed on endpoint $dest$ by user $user$ with arguments configured to connect to a remote TCP or OpenSSL endpoint with local echo disabled via $process$. + - field: dest + type: system + score: 20 + message: Socat was executed with local terminal echo disabled and a remote TCP or OpenSSL connection via Command Line [$process$] on endpoint [$dest$] by user [$user$]. threat_objects: - field: process type: process @@ -75,6 +74,7 @@ analytic_story: asset_type: Endpoint mitre_attack_id: - T1059 + - T1572 product: - Splunk Cloud - Splunk Enterprise