title: Connection Proxy
id: 72f4ab3f-787d-495d-a55d-68c2ff46cf4c
status: experimental
description: Detects setting proxy
author: Ömer Günal
date: 2020/06/17
references:
    - https://attack.mitre.org/techniques/T1090/
logsource:
    product: linux
detection:
    keyword:
        - 'http_proxy=*'
        - 'https_proxy=*'
    condition: keyword
falsepositives:
    - Legitimate administration activities
level: low
tags:
    - attack.defense_evasion