← Back to SOC feed Coverage →

ProxyTool2

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-07-07T11:00:00Z · Confidence: medium

Hunt Hypothesis

This detection targets adversaries leveraging the ProxyTool2 utility to establish covert command-and-control channels or exfiltrate data through proxy configurations within the Azure environment. Proactively hunting for this behavior allows the SOC team to identify early-stage reconnaissance activities and validate legitimate usage patterns before low-severity signals are overlooked in routine monitoring.

YARA Rule

rule ProxyTool2
{
strings:
	$STR1 = { 82 F4 DE D4 D3 C2 CA F5 C8 C8 D3 82 FB F4 DE D4 D3 C2 CA 94 95 FB D4 D1 C4 CF C8 D4 D3 89 C2 DF C2 87 8A CC 87 00 } // '%SystemRoot%\System32\svchost.exe -k' xor A7

condition:
	(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 1 string patterns in its detection logic.

False Positive Guidance

Here are 4 specific false positive scenarios for the ProxyTool2 detection rule in an enterprise environment, including suggested filters or exclusions:

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/Operation_Blockbuster/cert_wiper.yara