Kalambur Backdoor Curl TOR SOCKS Proxy Execution

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•2•0•42

Detects the execution of 'curl.exe' with command-line arguments indicating the use of SOCKS proxies (socks5h, socks5, socks4a) and targeting '.onion' domains. This combination is highly indicative of activity associated with the Kalambur backdoor, which leverages TOR for command and control.