PUA - Fast Reverse Proxy (FRP) Execution

Title: PUA - Fast Reverse Proxy (FRP) Execution
Status: test
Description:Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or firewall to the Internet.
References:
  -https://asec.ahnlab.com/en/38156/
  -https://github.com/fatedier/frp
Author: frack113, Florian Roth
Date: 2022-09-02
modified:2024-11-23
Tags:

• -'attack.command-and-control'
• -'attack.t1090'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
    Image|endswith:
      -'\frpc.exe'
      -'\frps.exe'

  selection_cli:
    CommandLine|contains: '\frpc.ini'
  selection_hashes:
    Hashes|contains:
      -'MD5=7D9C233B8C9E3F0EA290D2B84593C842'
      -'SHA1=06DDC9280E1F1810677935A2477012960905942F'
      -'SHA256=57B0936B8D336D8E981C169466A15A5FD21A7D5A2C7DAF62D5E142EE860E387C'

  condition:1 of selection_*
Falsepositives:
  -Legitimate use
Level: high