1200KM / detection
T1205.002 Socket Filters — Detection Rules
Detection workspace for T1205.002 Socket Filters: 0 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
No reviewed association in this snapshot.
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0162 Socket-filter trigger → on-host raw-socket activity → reverse connection (T1205.002)
AN0462 Analytic 0462
Adversary installs/uses packet-capture or raw-socket capability (WinPcap/Npcap, wpcap/packet DLLs or raw socket attach) and sets a filter. A crafted inbound packet is observed; within a short window the host process that loaded capture libraries initiates an outbound connection (e.g., reverse shell) to the packet origin.
AN0463 Analytic 0463
Process creates a raw/packet socket and attaches a (e)BPF filter (setsockopt SO_ATTACH_FILTER/ATTACH_BPF or bpf(BPF_PROG_LOAD)). Immediately after a matching inbound packet, the same process binds/connects outward to a remote host (reverse shell or beacon).
AN0464 Analytic 0464
Process opens /dev/bpf* (libpcap) or loads NetworkExtension filter, then after a crafted inbound packet the same process initiates an outbound connection to the trigger origin.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
T1205.002 simulation workspace
- Driver Load · DC0079
- Module Load · DC0016
- Network Connection Creation · DC0082
- Network Traffic Content · DC0085
- Process Creation · DC0032
- Service Creation · DC0060
No reviewed association in this snapshot.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.