Detecting SOCKS Proxies: Internal Pivot Listeners and Dynamic Forwarding

Attackers stand up SOCKS proxies on compromised hosts to reach segments they cannot route to directly, using SSH -D, Chisel, Meterpreter, Cobalt Strike or a bespoke listener. The proxy is rarely noisy on the host, so the useful signals are an unexpected listening socket and east-west traffic that follows the SOCKS handshake.

Signals at a Glance

Unexpected Listeners

Most workstations have no reason to accept a SOCKS connection. EDR platforms record listening sockets, which lets us flag any process that opens a listener on a classic proxy port or an unusual high port outside the normal application set:

// Microsoft Defender XDR (KQL) - new proxy-like listeners
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where ActionType == "ListeningConnectionCreated"
| where LocalPort in (1080, 1081, 9050, 9150, 8888, 10808)
| where InitiatingProcessFileName !in~ ("tor.exe", "firefox.exe", "chrome.exe")
| project Timestamp, DeviceName, LocalPort, InitiatingProcessFileName,
          InitiatingProcessCommandLine, InitiatingProcessAccountName
// tune/validate: the port list is a hunt starting point, not a boundary;
// pair with first-seen listening process per host to catch random ports.

Wire-Level SOCKS Handshakes

Zeek parses SOCKS4 and SOCKS5 requests into socks.log, recording the requested host, port and whether the proxy replied with success. Internal-to-internal SOCKS is rarely legitimate, which makes it a high-value hunt:

# Splunk (Zeek socks.log) - internal SOCKS use, ranked by distinct targets
index=zeek sourcetype=bro_socks
| where cidrmatch("10.0.0.0/8", 'id.resp_h') OR cidrmatch("192.168.0.0/16", 'id.resp_h')
| stats count AS requests, dc(request.host) AS targets, values(request.port) AS ports
    BY id.orig_h, id.resp_h, version
| where requests > 5
| sort - targets
# tune/validate: adjust the RFC 1918 ranges to your network and exclude
# approved forward proxies and security tooling.

• Follow the chain: the host with the listener is the pivot, and its outbound connections to internal services are the operator’s actions.
• Treat a SOCKS listener that appears minutes after an inbound administrative logon as higher risk than one on a developer machine.
• Alert on proxy settings that point a browser or tool at 127.0.0.1 on a high port when the process is a script interpreter.
• Use NGFW app-ID for socks to catch listeners on non-standard ports.