Suspicious Curl Usage with SOCKS Proxy or TOR

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects curl usage to access a SOCKS proxy or TOR. Normal users rarely use these proxies or onion services, making this activity potentially suspicious. Adversaries may exploit the curl utility to access their malicious domains, either to upload collected information or download potentially malicious software.

2025-02-13 00:00:00

None

5f837594-4c19-44b5-8e21-5651f1572492

attack.command-and-control attack.t1005

Nextron Sigma feed only (private)