Proxy Botnets & AI Agent Tricks: Defending Against Trust-Based Exploits

---
title: Suspicious Proxy Service Execution in User Writable Paths
id: 8a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects execution of known proxy binaries (3proxy, tinyproxy, squid) from directories writable by standard users or temporary directories, often indicating IoT botnet infection or malware proxy setup.
references:
  - https://attack.mitre.org/techniques/T1090/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1090.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\3proxy.exe'
      - '\tinyproxy.exe'
      - '\squid.exe'
      - '\nginx.exe'
  filter_legit:
    Image|contains:
      - '\Program Files\'
      - '\Program Files (x86)\'
  condition: selection and not filter_legit
falsepositives:
  - Legitimate portable proxy tools used by developers
level: high
---
title: Package Manager Spawning Shell
id: 9b2c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects package managers (npm, pip, dotnet) spawning cmd, powershell, or bash. This is a common behavior of malicious dependencies or typosquatting packages executing post-install scripts.
references:
  - https://attack.mitre.org/techniques/T1195/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.execution
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\npm.cmd'
      - '\node.exe'
      - '\pip.exe'
      - '\pip3.exe'
      - '\python.exe'
      - '\dotnet.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate build scripts that require shell environment setup
level: high
---
title: AI Orchestration Runtime Spawning System Shell
id: 0c3d4e5f-6a7b-8c9d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects Python or Node.js processes (commonly used for AI agents) spawning a shell. This may indicate a successful prompt injection or tool exploitation resulting in OS command execution.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
      - '/python3'
      - '/python'
      - '/node'
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/zsh'
  filter:
    ParentCommandLine|contains:
      - 'test'
      - 'build'
      - 'deploy'
  condition: selection and not filter
falsepositives:
  - Developer testing or legitimate automation scripts
level: medium

// Hunt for proxy binaries and suspicious child processes
let ProxyProcesses = DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ('3proxy.exe', 'tinyproxy.exe', 'squid.exe', 'privoxy.exe', 'nginx.exe')
| where FolderPath !contains "Program Files"; // Filter default installs

let PackageManagers = DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ('npm.cmd', 'pip.exe', 'pip3.exe', 'dotnet.exe', 'cargo.exe');

let SuspiciousChildren = DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ('npm.cmd', 'pip.exe', 'pip3.exe', 'python.exe', 'node.exe')
| where FileName in~ ('cmd.exe', 'powershell.exe', 'pwsh.exe', 'bash', 'sh');

union ProxyProcesses, SuspiciousChildren
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by Timestamp desc

-- Hunt for suspicious proxy binaries and network listeners
SELECT Pid, Name, Exe, Username, Cmdline
FROM pslist()
WHERE Name =~ 'proxy'
   OR Name =~ 'tinyproxy'
   OR Name =~ '3proxy'
   OR Name =~ 'squid'
   OR Exe =~ '/tmp/'
   OR Exe =~ '/dev/shm/'

-- Supplement with network connections to identify active proxy ports
SELECT Pid, RemoteAddress, RemotePort, State
FROM netstat()
WHERE State =~ 'ESTABLISHED'
  AND RemotePort IN (80, 443, 1080, 3128, 8080)
  AND Pid IN (SELECT Pid FROM pslist() WHERE Name =~ 'proxy' OR Name =~ 'node' OR Name =~ 'python')

#!/bin/bash

# Audit for Proxy Botnet Indicators
echo "[*] Checking for common proxy binaries in suspicious paths..."

# Define suspicious paths (writeable by users or temp)
SUSPICIOUS_PATHS=("/tmp" "/var/tmp" "/dev/shm" "/home" "/root")

# Check for common proxy binaries
for binary in 3proxy tinyproxy squid privoxy nginx iptables curl wget; do
    for path in "${SUSPICIOUS_PATHS[@]}"; do
        if find "$path" -name "$binary" -type f 2>/dev/null | grep -q .; then
            echo "[!] FOUND: $binary in $path"
            find "$path" -name "$binary" -type f -ls
        fi
    done
done

# Check for established connections on common proxy ports
echo "[*] Checking for active connections on proxy ports (1080, 3128, 8080)..."
netstat -antp 2>/dev/null | grep -E ':(1080|3128|8080|9050)' | grep ESTABLISHED

# Check for recently modified Python/Node packages (Supply Chain Hygiene)
echo "[*] Checking for recently modified site-packages or node_modules..."
find /usr/local/lib/python*/dist-packages -mtime -1 -type f 2>/dev/null | head -5
find ~ -name "node_modules" -type d -exec find {} -mtime -1 -type f \; 2>/dev/null | head -5

echo "[*] Audit complete."