Bandwidth monetisation client executed on a Linux host

Siemphony@siemphonymediumT1496.002unverifiedPlaybook · Destructive impact

Catches the launch of a client that sells the host's bandwidth and IP address to a proxyware service — the proxyjacking behaviour named in the technique — because the sustained data rate AN0081 really describes is a threshold over time that Sigma cannot express. The same strings are matched against both the command line and the binary path: these clients ship as native binaries under /opt or /usr/local/bin and as container images, so the brand string survives in argv either way, while the Image arm keeps the rule alive on a feed that carries exe= but no arguments at all. That second arm is not optional, because auditd's SYSCALL record holds only exe=, comm= and the syscall arguments — argv arrives in a separate EXECVE record where arguments containing spaces or quotes are hex-encoded and long ones are split into chunks — so this rule needs auditd with an execve rule loaded (no mainstream distribution ships one) AND a collector that reassembles and hex-decodes EXECVE argv; without the second, the command-line arm returns zero forever, and zero rows reads as quiet when it means blind. MITRE's ToolPattern knob names proxychains and 3proxy, both matched below; the proxyware brand list is authored here, carries the date it was last refreshed, and is the part that ages fastest, so a quiet result is weak evidence of absence. The ceiling is low by construction — renaming the binary or retagging the container image defeats the rule entirely, so it finds unsophisticated proxyjacking only, and the botnet, torrent-seeding and internet-scanning behaviours the technique also covers need the sustained-egress network leg this log source cannot aggregate. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0028, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Bandwidth monetisation client executed on a Linux host2id: 878e6aa4-903d-49b4-85ce-9a69a19f63743status: experimental4description: |5  Catches the launch of a client that sells the host's bandwidth and IP address6  to a proxyware service — the proxyjacking behaviour named in the technique —7  because the sustained data rate AN0081 really describes is a threshold over8  time that Sigma cannot express. The same strings are matched against both the9  command line and the binary path: these clients ship as native binaries under10  /opt or /usr/local/bin and as container images, so the brand string survives11  in argv either way, while the Image arm keeps the rule alive on a feed that12  carries exe= but no arguments at all. That second arm is not optional, because13  auditd's SYSCALL record holds only exe=, comm= and the syscall arguments —14  argv arrives in a separate EXECVE record where arguments containing spaces or15  quotes are hex-encoded and long ones are split into chunks — so this rule16  needs auditd with an execve rule loaded (no mainstream distribution ships one)17  AND a collector that reassembles and hex-decodes EXECVE argv; without the18  second, the command-line arm returns zero forever, and zero rows reads as19  quiet when it means blind. MITRE's ToolPattern knob names proxychains and20  3proxy, both matched below; the proxyware brand list is authored here, carries21  the date it was last refreshed, and is the part that ages fastest, so a quiet22  result is weak evidence of absence. The ceiling is low by construction —23  renaming the binary or retagging the container image defeats the rule24  entirely, so it finds unsophisticated proxyjacking only, and the botnet,25  torrent-seeding and internet-scanning behaviours the technique also covers26  need the sustained-egress network leg this log source cannot aggregate.27  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0028, not hand-written and not tested by its author. Any lab result is on this rule's own page.28references:29  - https://attack.mitre.org/techniques/T1496/00230  - https://attack.mitre.org/detectionstrategies/DET002831author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)32date: 2026-08-1633tags:34  - attack.impact35  - attack.t1496.00236logsource:37  category: process_creation38  product: linux39detection:40  selection_cmdline:41    CommandLine|contains:42      # Named by MITRE's ToolPattern knob for AN0081.43      - 'proxychains'44      - '3proxy'45      # Proxyware brands, assembled by the rule author, not by MITRE.46      # Last refreshed 2026-08-16 — re-check before relying on a quiet result.47      - 'honeygain'48      - 'earnapp'49      - 'traffmonetizer'50      - 'peer2profit'51      - 'packetstream'52      - 'packetshare'53      - 'repocket'54      - 'proxyrack'55      - 'pawns-cli'56      - 'iproyal'57      - 'bitping'58      - 'nodepay'59      - 'getgrass'60      - 'earnfm'61      - 'mysterium'62      - 'proxylite'63      - '9hits'64      - 'speedshare'65      - 'luminati'66      - 'brightdata'67  selection_image:68    Image|contains:69      # Same two lists against exe=, for feeds that carry no argv.70      - 'proxychains'71      - '3proxy'72      - 'honeygain'73      - 'earnapp'74      - 'traffmonetizer'75      - 'peer2profit'76      - 'packetstream'77      - 'packetshare'78      - 'repocket'79      - 'proxyrack'80      - 'pawns-cli'81      - 'iproyal'82      - 'bitping'83      - 'nodepay'84      - 'getgrass'85      - 'earnfm'86      - 'mysterium'87      - 'proxylite'88      - '9hits'89      - 'speedshare'90      - 'luminati'91      - 'brightdata'92  condition: selection_cmdline or selection_image93falsepositives:94  - "Administrators, penetration testers and authorised red teams running proxychains to route a tool through a jump host, or 3proxy as a sanctioned internal proxy, which is the intended use of both tools MITRE's ToolPattern knob names."95  - "Consumer-grade endpoints in BYOD or lab subnets where free VPN, free-internet and tethering apps bundle a proxyware SDK under these same brand strings. This is unsanctioned rather than adversary activity and will dominate hits in any estate with unmanaged Linux hosts."96  - "Organisations that legitimately buy residential proxy or web-scraping capacity. Fraud, brand-protection and threat-intelligence teams run these same clients under contract, and the execve record of a sanctioned deployment is identical to that of a hijacked host."97  - "Any command line that merely mentions a brand name without running the client — a package manager installing or removing it, a container image being pulled or tagged, an incident-response grep, or a configuration-management run that enforces its absence."98  - "Employees monetising an idle machine for personal income, which is a true positive for the technique but normally an acceptable-use matter rather than an intrusion, and which will account for most hits in a permissive environment."99level: medium

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((ProcessCommandLine contains "proxychains" or ProcessCommandLine contains "3proxy" or ProcessCommandLine contains "honeygain" or ProcessCommandLine contains "earnapp" or ProcessCommandLine contains "traffmonetizer" or ProcessCommandLine contains "peer2profit" or ProcessCommandLine contains "packetstream" or ProcessCommandLine contains "packetshare" or ProcessCommandLine contains "repocket" or ProcessCommandLine contains "proxyrack" or ProcessCommandLine contains "pawns-cli" or ProcessCommandLine contains "iproyal" or ProcessCommandLine contains "bitping" or ProcessCommandLine contains "nodepay" or ProcessCommandLine contains "getgrass" or ProcessCommandLine contains "earnfm" or ProcessCommandLine contains "mysterium" or ProcessCommandLine contains "proxylite" or ProcessCommandLine contains "9hits" or ProcessCommandLine contains "speedshare" or ProcessCommandLine contains "luminati" or ProcessCommandLine contains "brightdata") or (FolderPath contains "proxychains" or FolderPath contains "3proxy" or FolderPath contains "honeygain" or FolderPath contains "earnapp" or FolderPath contains "traffmonetizer" or FolderPath contains "peer2profit" or FolderPath contains "packetstream" or FolderPath contains "packetshare" or FolderPath contains "repocket" or FolderPath contains "proxyrack" or FolderPath contains "pawns-cli" or FolderPath contains "iproyal" or FolderPath contains "bitping" or FolderPath contains "nodepay" or FolderPath contains "getgrass" or FolderPath contains "earnfm" or FolderPath contains "mysterium" or FolderPath contains "proxylite" or FolderPath contains "9hits" or FolderPath contains "speedshare" or FolderPath contains "luminati" or FolderPath contains "brightdata"))

Splunk · SPL

Run this as a search.

index=* ((CommandLine="*proxychains*" OR CommandLine="*3proxy*" OR CommandLine="*honeygain*" OR CommandLine="*earnapp*" OR CommandLine="*traffmonetizer*" OR CommandLine="*peer2profit*" OR CommandLine="*packetstream*" OR CommandLine="*packetshare*" OR CommandLine="*repocket*" OR CommandLine="*proxyrack*" OR CommandLine="*pawns-cli*" OR CommandLine="*iproyal*" OR CommandLine="*bitping*" OR CommandLine="*nodepay*" OR CommandLine="*getgrass*" OR CommandLine="*earnfm*" OR CommandLine="*mysterium*" OR CommandLine="*proxylite*" OR CommandLine="*9hits*" OR CommandLine="*speedshare*" OR CommandLine="*luminati*" OR CommandLine="*brightdata*") OR (Image="*proxychains*" OR Image="*3proxy*" OR Image="*honeygain*" OR Image="*earnapp*" OR Image="*traffmonetizer*" OR Image="*peer2profit*" OR Image="*packetstream*" OR Image="*packetshare*" OR Image="*repocket*" OR Image="*proxyrack*" OR Image="*pawns-cli*" OR Image="*iproyal*" OR Image="*bitping*" OR Image="*nodepay*" OR Image="*getgrass*" OR Image="*earnfm*" OR Image="*mysterium*" OR Image="*proxylite*" OR Image="*9hits*" OR Image="*speedshare*" OR Image="*luminati*" OR Image="*brightdata*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.command_line) LIKE "*proxychains*" OR TO_LOWER(process.command_line) LIKE "*3proxy*" OR TO_LOWER(process.command_line) LIKE "*honeygain*" OR TO_LOWER(process.command_line) LIKE "*earnapp*" OR TO_LOWER(process.command_line) LIKE "*traffmonetizer*" OR TO_LOWER(process.command_line) LIKE "*peer2profit*" OR TO_LOWER(process.command_line) LIKE "*packetstream*" OR TO_LOWER(process.command_line) LIKE "*packetshare*" OR TO_LOWER(process.command_line) LIKE "*repocket*" OR TO_LOWER(process.command_line) LIKE "*proxyrack*" OR TO_LOWER(process.command_line) LIKE "*pawns-cli*" OR TO_LOWER(process.command_line) LIKE "*iproyal*" OR TO_LOWER(process.command_line) LIKE "*bitping*" OR TO_LOWER(process.command_line) LIKE "*nodepay*" OR TO_LOWER(process.command_line) LIKE "*getgrass*" OR TO_LOWER(process.command_line) LIKE "*earnfm*" OR TO_LOWER(process.command_line) LIKE "*mysterium*" OR TO_LOWER(process.command_line) LIKE "*proxylite*" OR TO_LOWER(process.command_line) LIKE "*9hits*" OR TO_LOWER(process.command_line) LIKE "*speedshare*" OR TO_LOWER(process.command_line) LIKE "*luminati*" OR TO_LOWER(process.command_line) LIKE "*brightdata*") OR (TO_LOWER(process.executable) LIKE "*proxychains*" OR TO_LOWER(process.executable) LIKE "*3proxy*" OR TO_LOWER(process.executable) LIKE "*honeygain*" OR TO_LOWER(process.executable) LIKE "*earnapp*" OR TO_LOWER(process.executable) LIKE "*traffmonetizer*" OR TO_LOWER(process.executable) LIKE "*peer2profit*" OR TO_LOWER(process.executable) LIKE "*packetstream*" OR TO_LOWER(process.executable) LIKE "*packetshare*" OR TO_LOWER(process.executable) LIKE "*repocket*" OR TO_LOWER(process.executable) LIKE "*proxyrack*" OR TO_LOWER(process.executable) LIKE "*pawns-cli*" OR TO_LOWER(process.executable) LIKE "*iproyal*" OR TO_LOWER(process.executable) LIKE "*bitping*" OR TO_LOWER(process.executable) LIKE "*nodepay*" OR TO_LOWER(process.executable) LIKE "*getgrass*" OR TO_LOWER(process.executable) LIKE "*earnfm*" OR TO_LOWER(process.executable) LIKE "*mysterium*" OR TO_LOWER(process.executable) LIKE "*proxylite*" OR TO_LOWER(process.executable) LIKE "*9hits*" OR TO_LOWER(process.executable) LIKE "*speedshare*" OR TO_LOWER(process.executable) LIKE "*luminati*" OR TO_LOWER(process.executable) LIKE "*brightdata*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(proxychains|3proxy|honeygain|earnapp|traffmonetizer|peer2profit|packetstream|packetshare|repocket|proxyrack|pawns-cli|iproyal|bitping|nodepay|getgrass|earnfm|mysterium|proxylite|9hits|speedshare|luminati|brightdata)</field>    <description>Bandwidth monetisation client executed on a Linux host (1/2)</description>    <mitre>      <id>T1496.002</id>    </mitre>  </rule>   <rule id="100001" level="7">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(proxychains|3proxy|honeygain|earnapp|traffmonetizer|peer2profit|packetstream|packetshare|repocket|proxyrack|pawns-cli|iproyal|bitping|nodepay|getgrass|earnfm|mysterium|proxylite|9hits|speedshare|luminati|brightdata)</field>    <description>Bandwidth monetisation client executed on a Linux host (2/2)</description>    <mitre>      <id>T1496.002</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / linux
Level: medium
Category: impact_destruction
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 878e6aa4-903d-49b4-85ce-9a69a19f6374

ATT&CKT1496.002

T1496.002Bandwidth Hijacking

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1496.002, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 5 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Add more specific keywords to the selection_cmdline and selection_image to reduce false positives
Exclude specific Image paths or CommandLine arguments that are known to be legitimate
Add a filter to exclude processes running under a specific user or group, such as a security testing user
Consider adding a threshold for the number of matches within a certain time frame to reduce noise

Declared by the author

Administrators, penetration testers and authorised red teams running proxychains to route a tool through a jump host, or 3proxy as a sanctioned internal proxy, which is the intended use of both tools MITRE's ToolPattern knob names.
Consumer-grade endpoints in BYOD or lab subnets where free VPN, free-internet and tethering apps bundle a proxyware SDK under these same brand strings. This is unsanctioned rather than adversary activity and will dominate hits in any estate with unmanaged Linux hosts.
Organisations that legitimately buy residential proxy or web-scraping capacity. Fraud, brand-protection and threat-intelligence teams run these same clients under contract, and the execve record of a sanctioned deployment is identical to that of a hijacked host.
Any command line that merely mentions a brand name without running the client — a package manager installing or removing it, a container image being pulled or tagged, an incident-response grep, or a configuration-management run that enforces its absence.
Employees monetising an idle machine for personal income, which is a true positive for the technique but normally an acceptable-use matter rather than an intrusion, and which will account for most hits in a permissive environment.

Lessonimpact destruction

impact destructionAI draft — unreviewed

01 · What this rule detects

This Sigma rule detects the execution of bandwidth monetisation clients on a Linux host. These clients are typically used to sell a device's bandwidth, often without the user's knowledge or consent, and can be a sign of malicious activity. The rule looks for specific command line arguments and image names associated with these clients to distinguish them from normal system activity.

02 · Telemetry you need

Log source: process_creation
Product: linux
Fields: CommandLine, Image
No specific audit settings are required, but process creation logging must be enabled.

03 · How the logic works

The rule uses two selections: selection_cmdline and selection_image. The selection_cmdline checks if the CommandLine field contains any of the specified keywords, such as proxychains or honeygain. The selection_image checks if the Image field contains any of the same keywords. The condition then combines these two selections with an or operator, meaning that if either the command line or image name matches any of the keywords, the rule will trigger.

04 · Common false positives

Legitimate use of proxychains for security testing or research purposes
Use of 3proxy for legitimate proxying needs
Installation of honeygain or other bandwidth monetisation clients by users who are aware of their activity
False positives from other software that happens to contain the specified keywords in their command line or image name

05 · Detection maturity

tier_1: The rule as written may generate a high volume of false positives and requires significant tuning to be effective.
tier_2: With additional keywords and exclusions, the rule can be made more specific and reduce noise, but may still require regular maintenance.
tier_3: Correlating this rule with other signals, such as network traffic or system calls, can help to confirm the presence of malicious activity and reduce false positives, making it a more reliable indicator of compromise.

Related detections1 nearby

Detect DNS lookups for bandwidth-monetization proxyware services

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/878e6aa4-903d-49b4-85ce-9a69a19f6374

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Bandwidth monetisation client executed on a Linux host

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it