SprySOCKS Windows Variant: Active Exploitation of Government Networks — Detection and Response

---
title: Potential SprySOCKS Windows Variant Execution
id: 8a4c2d1e-5f6a-4b3c-9d8e-1a2b3c4d5e6f
status: experimental
description: Detects the execution of processes potentially matching the SprySOCKS Windows variant based on naming conventions or proxy behavior initiation.
references:
 - https://www.bleepingcomputer.com/news/security/windows-version-of-sprysocks-linux-malware-used-to-attack-govt-orgs/
author: Security Arsenal
date: 2026/04/22
tags:
  - attack.command_and_control
  - attack.t1090.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|contains:
      - 'sprysocks'
  selection_cli:
    CommandLine|contains:
      - '-p '
      - '--port'
  condition: 1 of selection_*
falsepositives:
  - Legitimate proxy tools used by administrators (unlikely to use sprysocks naming)
level: high
---
title: Suspicious Proxy Service Creation
id: 9b5d3e2f-6g7b-5c4d-0e9f-2b3c4d5e6f7a
status: experimental
description: Detects the creation of a Windows Service that points to a binary in a user directory, a common persistence mechanism for trojans like SprySOCKS.
references:
  - https://attack.mitre.org/techniques/T1543/003/
author: Security Arsenal
date: 2026/04/22
tags:
  - attack.persistence
  - attack.t1543.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'sc create'
      - 'New-Service'
    CommandLine|contains:
      - '\\AppData\\'
      - '\\Public\\'
  filter:
    CommandLine|contains:
      - 'Windows Defender'
      - 'Update'
  condition: selection and not filter
falsepositives:
  - Administrator installing legitimate software to user directories
level: medium

// Hunt for SprySOCKS process execution and network listeners
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessName has "sprysocks" 
   or CommandLine has_any("-p", "--port", "-l", "--listen")
| project Timestamp, DeviceName, AccountName, ProcessName, CommandLine, InitiatingProcessFileName
| join kind=inner (
    DeviceNetworkEvents
    | where ActionType == "Listening"
    | where LocalPort in (1080, 8080, 3128, 10800) // Common proxy ports
) on DeviceName
| project Timestamp, DeviceName, AccountName, ProcessName, LocalPort, LocalIPAddress

-- Hunt for SprySOCKS processes and suspicious network listeners
SELECT 
  Pid, 
  Name, 
  CommandLine, 
  Exe, 
  Username 
FROM pslist()
WHERE Name =~ "sprysocks" 
   OR Exe =~ "sprysocks"
   OR CommandLine =~ "-(p|port)"

-- Correlate with network listeners
SELECT 
  Pid, 
  Family, 
  LocalAddress, 
  LocalPort 
FROM listen_sockets()
WHERE LocalPort > 1024 
  AND Family = 2 // IPv4
  AND Pid IN (SELECT Pid FROM pslist() WHERE Name =~ "sprysocks" OR Username NOT IN ("NT AUTHORITY\\SYSTEM", "NT AUTHORITY\\NETWORK SERVICE", "NT AUTHORITY\\LOCAL SERVICE"))

# SprySOCKS Windows Variant - Hunt and Remediation Script
# Run as Administrator

Write-Host "[*] Starting hunt for SprySOCKS artifacts..." -ForegroundColor Cyan

# 1. Check for suspicious processes
$suspiciousProcesses = Get-Process | Where-Object { 
    $_.ProcessName -like "*sprysocks*" -or 
    $_.MainWindowTitle -like "*proxy*" 
}

if ($suspiciousProcesses) {
    Write-Host "[!] ALERT: Found potential SprySOCKS processes:" -ForegroundColor Red
    $suspiciousProcesses | Format-Table Id, ProcessName, Path -AutoSize
    
    # Kill process
    foreach ($proc in $suspiciousProcesses) {
        try {
            Stop-Process -Id $proc.Id -Force
            Write-Host "    [+] Terminated process $($proc.Id)" -ForegroundColor Green
        } catch {
            Write-Host "    [-] Failed to terminate process $($proc.Id)" -ForegroundColor Yellow
        }
    }
} else {
    Write-Host "[-] No suspicious processes found by name." -ForegroundColor Green
}

# 2. Check for services running from User Profile directories (Persistence)
Write-Host "[*] Scanning for suspicious services..." -ForegroundColor Cyan
$maliciousServices = Get-WmiObject Win32_Service | Where-Object { 
    $_.PathName -match "C:\\Users\\" -and 
    $_.PathName -notmatch "Windows\\System32" -and
    $_.State -eq "Running"
}

if ($maliciousServices) {
    Write-Host "[!] ALERT: Found services running from User directories (Potential Persistence):" -ForegroundColor Red
    $maliciousServices | Format-List Name, DisplayName, PathName, State
    
    # Prompt to disable (Manual verification recommended)
    Write-Host "[!] WARNING: Please review the above services manually before deletion." -ForegroundColor Yellow
} else {
    Write-Host "[-] No suspicious services found." -ForegroundColor Green
}

# 3. Check Network Listeners on common proxy ports
Write-Host "[*] Checking for active proxy ports..." -ForegroundColor Cyan
$proxyPorts = @(1080, 8080, 10800)
$listeners = Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue | Where-Object { $proxyPorts -contains $_.LocalPort }

if ($listeners) {
    Write-Host "[!] ALERT: Found listeners on common proxy ports:" -ForegroundColor Red
    $listeners | Format-Table LocalAddress, LocalPort, OwningProcess -AutoSize
} else {
    Write-Host "[-] No listeners on common proxy ports found." -ForegroundColor Green
}

Write-Host "[*] Scan complete." -ForegroundColor Cyan