T1205.002 — Socket Filters

Tactics: Stealth, Persistence, Command and Control · Platforms: Linux, macOS, Windows

Adversaries may attach filters to a network socket to monitor then activate backdoors used for persistence or command and control. With elevated permissions, adversaries can use features such as the `libpcap` library to open sockets and install filters to allow or disallow certain types of data to…

Sub-technique of Traffic Signaling (T1205).

Sigma detection rules (3)

title: "T1205.002 Traffic Signaling: Socket Filters"
id: dde112e4-7398-407f-b992-b9790f192437
description: 'Detects loading of packet-capture libraries (wpcap/packet/npf/npcap). (Data Component: Module Load; baseline tier: windows-eventid.) Tune using: TimeWindow, CaptureLibIndicators, AllowedInstallers, ReversePorts.'
references:
  - https://attack.mitre.org/techniques/T1205/002
author: Shahrukh Khan
date: 2026-05-29
license: MIT
tags:
  - attack.stealth
  - attack.persistence
  - attack.command-and-control
  - attack.t1205.002

logsource:
  category: image_load
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '7'
    ImageLoaded|endswith:
      - '\wpcap.dll'
      - '\packet.dll'
      - '\npf.sys'
      - '\npcap.sys'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection and not filter_system_account

falsepositives:
  - Legitimate packet-capture tools (Wireshark etc).

level: medium

title: "T1205.002 Traffic Signaling: Socket Filters"
id: ae0bc593-66d4-41e6-bd02-ce15b5233f76
description: 'Socket-filter trigger to on-host raw-socket activity to reverse connection (T1205.002). (Retargeted to the network_connection auditd telemetry that actually captures this techniques behavior; see logsource below.) Fixed: added detection of the setsockopt syscall with SO_ATTACH_FILTER/SO_ATTACH_BPF socket options, which is the actual filter-attachment step this technique depends on; the original socket(AF_PACKET) heuristic is retained as a lower-fidelity secondary indicator since opening a raw socket alone does not confirm a filter was installed. Tune using: UserContext, MinPayloadEntropy, AFPacketAllowList.'
references:
  - https://attack.mitre.org/techniques/T1205/002
author: Shahrukh Khan
date: 2026-05-09
modified: 2026-07-26
license: MIT
tags:
  - attack.stealth
  - attack.persistence
  - attack.command-and-control
  - attack.t1205.002

logsource:
  category: network_connection
  product: linux

detection:
  selection_socket:
    type: SYSCALL
    syscall: socket
    a0: '17'
    exe|contains: '/tmp/'
  selection_attach:
    type: SYSCALL
    syscall: setsockopt
    a1: '1'
    a2:
      - '26'
      - '50'

  condition: selection_attach or selection_socket

falsepositives:
  - Raw socket / AF_PACKET usage is rare outside legitimate network diagnostic tools (tcpdump, scapy scripts); tcpdump and similar packet-capture tools also legitimately call setsockopt with SO_ATTACH_FILTER to install their own BPF capture filter, so selection_attach alone will match normal packet-capture tooling and should be scoped with UserContext/AFPacketAllowList. Payload entropy (MinPayloadEntropy) cannot be computed from a socket()/setsockopt() syscall record alone and needs packet capture.

level: high

title: "T1205.002 Traffic Signaling: Socket Filters"
id: b8517828-de4a-4c96-a589-425584c84cc5
description: 'Socket-filter trigger → on-host raw-socket activity → reverse connection (T1205.002). (Retargeted to the network_connection macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: BPFDevicePath, DeveloperMode.'
references:
  - https://attack.mitre.org/techniques/T1205/002
author: Shahrukh Khan
date: 2026-01-04
license: MIT
tags:
  - attack.stealth
  - attack.persistence
  - attack.command-and-control
  - attack.t1205.002

logsource:
  category: network_connection
  product: macos

detection:
  selection_port:
    DestinationPort:
      - 4444
      - 1337
      - 31337
      - 8080
  selection_proc:
    Image|contains:
      - '/private/tmp/'
      - '/private/var/tmp/'
  condition: selection_port and selection_proc

falsepositives:
  - Passive BPF-based socket filter backdoors only generate a normal connection after receiving a magic packet trigger, so the device-open event itself is not visible in network_connection telemetry and legitimate tools such as tcpdump also open the same BPF devices.

level: high

Related sub-techniques

• T1205.001 Port Knocking

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1205.002 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan