Fast Reverse Proxy (FRP) Execution

SigmaHQ Detections@sigmaHQ

•updated Nov 25, 2024•0•32

Detects the execution of Fast Reverse Proxy (FRP) client or server binaries, or command-line arguments indicative of FRP configuration files. FRP is a legitimate tool that can be used by adversaries to establish command and control (C2) channels by exposing local services behind NAT or firewalls to the internet, effectively creating a proxy.