GhostSocks Network Relay Execution Parameters
Identifies GhostSocks executing with command line parameters specifically pointing to remote relay nodes, obfuscating the final exfiltration destination.
Microsoft Sentinel (KQL)

Identifies GhostSocks executing with command line parameters specifically pointing to remote relay nodes, obfuscating the final exfiltration destination.

Already have an account?