{"id":"72f4ab3f-787d-495d-a55d-68c2ff46cf4c","title":"Connection Proxy","description":"Detects setting proxy configuration","author":"Ömer Günal","status":"test","level":"low","date":"2020-06-17","modified":"2022-10-05","tags":["attack.command-and-control","attack.t1090"],"technique_ids":["T1090"],"logsource":{"product":"linux","category":"process_creation"},"falsepositives":["Legitimate administration activities"],"references":[],"source_path":"rules/linux/process_creation/proc_creation_lnx_proxy_connection.yml","source_sha256":"e1716fa736e1d30049566d9834a60eabe184d31669d8b9aa90525ed22800f8ea","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_proxy_connection.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Connection Proxy\nid: 72f4ab3f-787d-495d-a55d-68c2ff46cf4c\nstatus: test\ndescription: Detects setting proxy configuration\nauthor: Ömer Günal\ndate: 2020-06-17\nmodified: 2022-10-05\ntags:\n    - attack.command-and-control\n    - attack.t1090\nlogsource:\n    product: linux\n    category: process_creation\ndetection:\n    selection:\n        CommandLine|contains:\n            - 'http_proxy='\n            - 'https_proxy='\n    condition: selection\nfalsepositives:\n    - Legitimate administration activities\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1090","id":"T1090","name":"Proxy","page":"techniques/enterprise/T1090/"}],"data_path":"data/detection-rules/72f4ab3f-787d-495d-a55d-68c2ff46cf4c.json","kind":"sigma"}