TencShell - SOCKS5 Multiplexed Pivot Tunnel (T1090.001)
Detects the SOCKS5 proxy server module multiplexing connections to support internal network pivoting. This rule specifically looks for network connections originating from 'setup.exe' to internal IP ranges (10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12) with a high connection count (over 50) to indicate potential SOCKS5 proxy activity.
Microsoft Sentinel (KQL)
