Velvet Ant Perl SOCKS Proxy Tunnel via Web Process Parent (T1090.001)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects the execution of Perl-based SOCKS proxy tunneling activity on Linux systems, as observed in Velvet Ant operations. The rule identifies Perl processes that contain socket/fork/daemonization indicators when spawned by web server processes like Nginx, Apache, or common shells used in CGI contexts, suggesting the exploitation of a web application to establish an internal network pivot.