Salt Typhoon RedMike STOWAWAY Multi-Hop SOCKS5 Relay Negotiation Outbound

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•0

Detects outbound SOCKS5 negotiation patterns commonly used by the Salt Typhoon threat group's STOWAWAY tool. The rule triggers on TCP traffic initiating a SOCKS5 handshake (represented by the sequence |05 01 00|) to non-standard ports, excluding common proxy ports (1080, 3128, 8080, 8443, 9050). This behavior is indicative of a multi-hop SOCKS5 relay or command-and-control connection.