WormFrp Opens a Reverse Proxy and SOCKS5 Tunnel

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•0•0•7

Detects a custom frp process enabling both reverse proxy and SOCKS5 functionality from an endpoint not approved as a proxy server. This rule specifically looks for process creation events where the executable name matches common frp variants (wormfrp, frpc, ssh) and the command line arguments indicate the setup of a reverse proxy, SOCKS5 tunnel, or related server connection parameters.