How do you detect proxychains and multi-hop proxy pivoting?

Detect proxychains on the host through the wrapper (proxychains or proxychains4 as a command or parent), configuration files such as proxychains.conf and a [ProxyList] section, the libproxychains LD_PRELOAD hook and the PROXYCHAINS_CONF_FILE variable, using auditd, Sigma and file integrity monitoring. On the network, map east-west SOCKS flows from Zeek socks.log and flag a host that is both a SOCKS server and a client of another hop. Allow-list penetration-testing and red-team infrastructure first, and keep the rules active on everything else.

Detecting proxychains: Chained-Proxy Pivoting and Config Artifacts

proxychains (and its maintained fork, proxychains-ng, installed as proxychains4) hooks network calls in a target program using LD_PRELOAD and routes them through a configured list of SOCKS4, SOCKS5 or HTTP proxies. The chain modes are strict_chain, dynamic_chain and random_chain. Operators use it to push scanners and administration tools through one or more pivots, which is multi-hop proxying.

Signals at a Glance

Signal	Where	ATT&CK
proxychains or proxychains4 as the parent or wrapper of a scanner or client	auditd, Sysmon for Linux, EDR	T1090.003
proxychains.conf or proxychains4.conf created or edited in a user or temp path	File events, FIM	T1090.003
libproxychains4.so loaded through LD_PRELOAD by an unrelated process	EDR module-load, auditd	T1574.006
Sequential SOCKS connections hop to hop between internal hosts	Zeek socks.log, flow	T1090.001
PROXYCHAINS_CONF_FILE set in the process environment	EDR environment capture	T1090.003

Execution and Config Artifacts

The wrapper appears in the process tree: the operator prefixes a tool such as nmap, ssh or curl with proxychains4. The config lists the chain in [ProxyList] and usually points the first hop at a local SOCKS listener on 127.0.0.1. A Sigma rule for the wrapper and the preload:

title: proxychains Wrapper Execution
logsource:
  category: process_creation
  product: linux
detection:
  selection_wrapper:
    Image|endswith:
      - '/proxychains'
      - '/proxychains4'
  selection_parent:
    ParentCommandLine|contains:
      - 'proxychains'
  selection_env:
    CommandLine|contains:
      - 'LD_PRELOAD=libproxychains'
      - 'PROXYCHAINS_CONF_FILE'
  condition: selection_wrapper or selection_parent or selection_env
level: high
# tune/validate: expect penetration-testing hosts and red-team jump boxes;
# allow-list them by hostname and keep the rule firing everywhere else.

Config creation is a useful second layer, since chains are written per engagement and the wrapper itself can be renamed:

# auditd - watch for proxychains configs and the preload library
-w /etc/proxychains.conf -p wa -k proxychains_cfg
-w /etc/proxychains4.conf -p wa -k proxychains_cfg
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/proxychains4 -k proxychains_exec
# tune/validate: per-user configs live in ~/.proxychains/; add FIM for home
# directories on servers or hunt with a file-content search for [ProxyList].

Multi-Hop Behaviour on the Network

The compromised host runs the wrapper, and the first hop is often a local SOCKS port that forwards to the next pivot. East-west, you see a series of SOCKS or tunnel connections where each host talks only to the next one. Draw the graph from Zeek socks.log and flow data and mark any host that is both a SOCKS server and a SOCKS client:

Alert when a host is destination of a SOCKS handshake and, within minutes, the source of another to a different internal host.
Find scanner-like fan-out (many ports, many hosts) originating from a server and arriving through a single local proxy port.
Check the first-hop listener, usually 127.0.0.1:9050 or 1080, against the owning process.
Treat Windows equivalents (Proxifier or proxychains-windows builds) the same: look for the wrapper binary and proxy configuration files.

Vetted sources

Use SigmaHQ Linux rules for proxy tools and LD_PRELOAD abuse, Elastic rules for Linux proxy and preload behaviour, the proxychains-ng documentation for configuration grammar, Zeek socks.log and your auditd baseline. Always baseline your own environment — penetration-test infrastructure legitimately uses proxychains and must be allow-listed explicitly.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Execution and Config Artifacts

Multi-Hop Behaviour on the Network

Build Detections That Fire

Protocol Tunneling Detection

Detection Hub

SOCKS Proxy Detection

SSH Tunnel Detection