IOX Tunneling Tool Execution Detection

SigmaHQ Detections@sigmaHQ

•updated Nov 25, 2024•0•13

This rule detects the execution of the IOX tunneling tool, which is used for port forwarding and intranet proxy purposes. It specifically looks for the executable name 'iox.exe' and common command-line arguments associated with its forwarding and proxy functionalities, such as '.exe fwd -l', '.exe fwd -r', '.exe proxy -l', and '.exe proxy -r'. Additionally, it includes specific MD5, SHA1, and SHA256 hashes for version 0.4 of the tool to enhance detection accuracy.