Skip to content

Add socat utility detections - #4253

Open
themaryjo wants to merge 3 commits into
developfrom
add-socat-utility-detections
Open

Add socat utility detections#4253
themaryjo wants to merge 3 commits into
developfrom
add-socat-utility-detections

Conversation

@themaryjo

@themaryjo themaryjo commented Sep 1, 2026

Copy link
Copy Markdown

Details

Adding detections for socat utility

###Story
MacOS Persistence Techniques

###Detections

  • Socat Utility Listener Binding Executable: Detects the execution of the socat utility with command-line arguments that configure a TCP or OpenSSL listener and bind an executable to incoming connections.
  • Socat Utility Remote TCP Connection with Echo Disabled: Detects the execution of the socat utility on a MacOS endpoint with command-line arguments that connect to a remote TCP endpoint while disabling local terminal echo.

Checklist

  • Validate name matches <platform>_<mitre att&ck technique>_<short description> nomenclature
  • CI/CD jobs passed ✔️
  • Validated SPL logic.
  • Validated tags, description, and how to implement.
  • Verified references match analytic.
  • Confirm updates to lookups are handled properly.

@onurmerdogan onurmerdogan added this to the v6.6.0 milestone Sep 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants