HAProxy network connections missing corresponding server-side log entries

Arnold Chan@slaz

•updated Sep 5, 2026•0•0•0

This rule identifies a discrepancy between actual network connections processed by HAProxy and the corresponding entries in its server-side logs. Such inconsistencies can indicate the presence of a malicious backdoor compiled into or injected into the HAProxy process, designed to facilitate C2 traffic while evading standard monitoring by suppressing or omitting logging for those connections.