Linux Process Creation with Proxy Environment Variables

SigmaHQ Detections@sigmaHQ

•updated Jun 4, 2025•1•0•23

Detects the creation of a process that includes environment variables for HTTP or HTTPS proxy settings in its command line. This can indicate an attempt to route network traffic through a proxy, potentially for command and control or to bypass network restrictions.