SOCKS Proxy Used as External C2 Relay
This rule detects the use of a SOCKS proxy as an external Command and Control (C2) relay. Specifically, it looks for TCP traffic on port 1080 (a common SOCKS proxy port) from the home network to any destination, and checks for the SOCKS version 5 handshake initiation sequence (05 01 00) at the beginning of the payload. This pattern indicates a client attempting to establish a SOCKSv5 connection, which can be used by malware for C2 communication to evade detection and bypass network restrictions.
Suricata
