GhostSocks Proxy Tunnel Execution

Ibrahim Saud@tektrix

•updated Jun 23, 2026•2•0•6

Identifies the GhostSocks tunneling binary (or Go/Python equivalent) executing and establishing a SOCKS5 relay to an external node. This rule correlates process command line arguments indicative of GhostSocks or SOCKS5 server/relay/listen functionality with network connections on common SOCKS proxy ports (1080, 1081, 9050).