Finding SOCKS with Proxywatch
specterops.io | blog
Summary
Adversaries use SOCKS proxy tunnels to pivot within environments and to execute code against compromised systems without bringing tools to the system. Defenders often lack reliable guidance to detect proxying behavior, falling back to preset rules based on static indicators or process-port baselines. This blog post highlights Proxywatch, a proof-of-concept release by SpecterOps, to detect SOCKS proxies and other pivoting methods through behavior-based detection.
- Published
- Collected
--- id: 9397 title: "Finding SOCKS with Proxywatch" source_domain: specterops.io source_url: "https://specterops.io/blog/2026/07/09/finding-socks-with-proxywatch/" published_at: "2026-07-09T16:00:00Z" phying_url: "https://phying.com/item/9397" lang: en --- # Finding SOCKS with Proxywatch ## Summary Adversaries use SOCKS proxy tunnels to pivot within environments and to execute code against compromised systems without bringing tools to the system. Defenders often lack reliable guidance to detect proxying behavior, falling back to preset rules based on static indicators or process-port baselines. This blog post highlights Proxywatch, a proof-of-concept release by SpecterOps, to detect SOCKS proxies and other pivoting methods through behavior-based detection. ## Intelligence Metadata - **Sources:** specterops.io - **Published:** 2026-07-09T16:00:00Z - **Original:** https://specterops.io/blog/2026/07/09/finding-socks-with-proxywatch/ - **Phying News:** https://phying.com/item/9397