Finding SOCKS with Proxywatch

ProxyWatch is a behavior-focused endpoint detection tool designed to identify SOCKS proxy pivots and proxied execution used by attackers to evade EDR. The post explains how adversaries use SOCKS/SSH tunneling and C2 features to pivot, details ProxyWatch’s telemetry collection, 83 behavioral signals, and a local ML model that learns from rule outputs, and provides example detections and deployment guidance for defenders.