[[ fm.text ]] Click here

Fast reverse proxy (FRP) client or server execution on Linux

SIGMA detection rule by Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a · Apache-2.0

Detects frpc or frps execution on Linux, post-exploitation C2 tunneling tool abused in Sliver campaign.

title: Fast reverse proxy (FRP) client or server execution on Linux
id: 7d12a3b4-e9c8-4f51-b8d2-3a1b4c5d6e7f
status: experimental
description: |
  Detects frpc or frps execution on Linux, post-exploitation C2 tunneling tool abused in Sliver campaign. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
  Détecte l'exécution du binaire FRP (Fast Reverse Proxy) client (frpc) ou serveur (frps) sur Linux. FRP est un outil légitime open-source fréquemment abusé en post-exploitation pour le tunneling C2 et le contournement de firewall. La détection basée sur l'image évite les faux positifs de sous-chaîne (xfrpc, ifrpc). frps est aussi suspect sur un hôte compromis. Le filtre filter_authorized_vpn exclut les chemins d'installation légitimes connus. ANGLE MORT : si frpc est renommé ou exécuté depuis un chemin personnalisé non couvert par filter_authorized_vpn, la règle déclenche (FP légitime possible). Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.
references:
  - https://github.com/fatedier/frp
  - https://attack.mitre.org/techniques/T1572/
  - https://ctrlaltintel.com/threat%20research/FortiWeb-Sliver/
author: Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a
date: 2026-01-08
modified: 2026-06-22
related:
  - id: 8f3c2e91-7b6a-4e77-9cfa-2a1e9d4cbe12
    type: similar
  - id: c3e7f5a8-1b2d-4f9c-88a0-9d1e2f3a4b5c
    type: similar
tags:
  - attack.t1572
  - attack.command-and-control
logsource:
  category: process_creation
  product: linux

detection:
  # Primary signal: exact binary name match (endswith prevents substring match on 'xfrpc').
  selection_frp_binary:
    Image|endswith:
      - '/frpc'
      - '/frps'

  # FRP invoked by name in CLI with TOML config (new config format, FRP >= 0.52).
  selection_frp_cli_toml:
    CommandLine|contains|all:
      - 'frpc'
      - '.toml'

  selection_frps_cli_toml:
    CommandLine|contains|all:
      - 'frps'
      - '.toml'

  # Angle mort: FRP versions prior to 0.52 use INI config files (.ini extension).
  # An attacker using an older FRP build would escape detection with the .toml selectors.
  selection_frp_cli_ini:
    CommandLine|contains|all:
      - 'frpc'
      - '.ini'

  selection_frps_cli_ini:
    CommandLine|contains|all:
      - 'frps'
      - '.ini'

  # ANGLE MORT CORRIGÉ (second challenge): FRP >= 0.56 supporte aussi le format YAML
  # (.yaml / .yml). Un attaquant utilisant un build récent avec config YAML ne matche pas
  # les sélections .toml ou .ini ci-dessus si le binaire est renommé.
  selection_frp_cli_yaml:
    CommandLine|contains|all:
      - 'frpc'
      - '.yaml'

  selection_frps_cli_yaml:
    CommandLine|contains|all:
      - 'frps'
      - '.yaml'

  # Angle mort: FRP binary renamed (e.g. to 'sshd', 'systemd-network').
  # If executed from /tmp, /dev/shm or /var/tmp it is always suspicious regardless of name.
  # This branch generates more FP but catches masquerade scenarios.
  selection_frp_from_tmp:
    Image|contains:
      - '/tmp/'
      - '/dev/shm/'
      - '/var/tmp/'
    CommandLine|contains:
      - 'server_addr'    # FRP TOML key present in frpc config
      - 'server_port'    # FRP TOML/INI key present in frpc config
      - 'remote_port'    # FRP tunnel definition key

  filter_authorized_vpn:
    Image|startswith:
      - '/etc/frp/'
      - '/usr/local/etc/frp/'
      - '/opt/frp/'

  condition: (selection_frp_binary or selection_frp_cli_toml or selection_frps_cli_toml or selection_frp_cli_ini or selection_frps_cli_ini or selection_frp_cli_yaml or selection_frps_cli_yaml or selection_frp_from_tmp) and not filter_authorized_vpn

fields:
  - Computer
  - User
  - Image
  - CommandLine
  - ParentImage
  - ParentCommandLine
  - ProcessId
  - ParentProcessId

falsepositives:
  - Authorized remote maintenance using FRP in enterprise VPN infrastructure (filter by Image path via filter_authorized_vpn)
  - DevOps tunneling for SSH forwarding in approved CI/CD pipelines
  - Corporate remote access solutions built on FRP (add install path to filter_authorized_vpn)
  - Older FRP builds using .ini config format on authorized hosts (new branch may trigger)
  - "selection_frp_from_tmp: legitimate test or staging scripts using FRP from temp paths (verify Image hash and owner)"
  - "Second-pass challenge fix (2026-06-22): ajout de selection_frp_cli_yaml / selection_frps_cli_yaml pour couvrir FRP >= 0.56 avec config .yaml. FP additionnels si .yaml apparait dans une CLI legitime avec 'frpc' en sous-chaine."

level: medium

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

8cd298d8-0b83-4ace-b5bc-cb5906f28e35

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion