Phoenix
Sigma IntelligenceBeta
Emerging Threats
Malware2025

Kalambur Backdoor Curl TOR SOCKS Proxy Execution

1Rules
1References
1Folders
2025-02-11Latest
Summary

Kalambur Backdoor Curl TOR SOCKS Proxy Execution is tracked here as a malware family or toolset with 1 Sigma detection spanning 2025. Coverage centers on windows / process_creation.

Related Detections
Search this threat
Emerging Threathighexperimental

Kalambur Backdoor Curl TOR SOCKS Proxy Execution

Detects the execution of the "curl.exe" command, referencing "SOCKS" and ".onion" domains, which could be indicative of Kalambur backdoor activity.

WindowsProcess Creation
TA0002 · ExecutionTA0011 · Command and ControlT1090 · ProxyT1573 · Encrypted Channel+4
Arda Buyukkaya (EclecticIQ)Tue Feb 112025
References
1
Resolving title…
blog.eclecticiq.com