title: Connection Proxy
id: 72f4ab3f-787d-495d-a55d-68c2ff46cf4c
status: test
description: Detects setting proxy
author: Ömer Günal
references:
  - https://attack.mitre.org/techniques/T1090/
date: 2020/06/17
modified: 2021/11/27
logsource:
  product: linux
detection:
  keywords:
    - 'http_proxy=*'
    - 'https_proxy=*'
  condition: keywords
falsepositives:
  - Legitimate administration activities
level: low
tags:
  - attack.defense_evasion