Showboat - Custom Port 4444 SOCKS5 Tunneling (T1090.003)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•1

Tracks processes (specifically hollowed svchost) generating high-volume, long-duration network sessions over port 4444, characteristic of Showboat's internal SOCKS5/Portmap routing.