DarkWire Proxy Staging via Firewall Rule and Masqueraded Process

Kaung Khant Ko@kaungkhantko

•updated yesterday•3•0•4

Detects indicators of DarkWire proxy staging by identifying the creation of a netsh firewall rule named 'ss1' or the execution of csrss.exe or vmtoolsd.exe from non-standard directory paths (often associated with SoftEther proxy staging).