Detects CowTunnel Linux reverse-proxy tunnel (NSS wrapper + FRP client) used for outbound access/pivoting in React2Shell

Hunt Hypothesis

This hypothesis detects adversaries leveraging CowTunnel’s NSS wrapper and FRP client to establish covert reverse-proxy tunnels that facilitate stealthy outbound data exfiltration and lateral movement within Linux environments. SOC teams should proactively hunt for this specific React2Shell activity in Azure Sentinel because these sophisticated tunneling mechanisms often bypass standard network controls, enabling attackers to maintain persistent command-and-control channels while pivoting through compromised hosts.

YARA Rule

rule HKTL_CowTunnel_Dec25 {
   meta:
      description = "Detects CowTunnel Linux reverse-proxy tunnel (NSS wrapper + FRP client) used for outbound access/pivoting in React2Shell activity"
      author = "RussianPanda"
      date = "2025-12-08"
      score = 85
      reference = "https://www.huntress.com/blog/peerblight-linux-backdoor-exploits-react2shell"
      hash = "776850a1e6d6915e9bf35aa83554616129acd94e3a3f6673bd6ddaec530f4273"
      id = "83155e55-0074-52d9-95ef-8486139814d1"
   strings:
      $s1 = "cannot create proxy service, it should not happenned!"
      $s2 = "[nss] encrypt_data"
      $s3 = "[nss] decrypt_data"
   condition:
      uint32(0) == 0x464c457f and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• https://www.huntress.com/blog/peerblight-linux-backdoor-exploits-react2shell
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the CowTunnel Linux reverse-proxy tunnel detection rule, including suggested filters and exclusions:

• Scheduled Backup Agent Communication

  • Scenario: The enterprise backup solution (e.g., Veeam or Commvault) running on a Linux jump host utilizes an NSS-wrapped FRP client to establish persistent outbound tunnels for off-site repository synchronization. This scheduled job runs nightly at 02:00 AM, triggering the rule during its connection handshake and data transfer phases.
  • Filter/Exclusion: Create a whitelist exclusion based on the specific backup service account (e.g., svc_backup) and restrict the detection to exclude traffic originating from known backup server IP ranges (10.20.45.x) during the defined maintenance window (01:30–03:30).

• CI/CD Pipeline Artifact Upload

  • Scenario: A Jenkins or GitLab Runner node executes a post-build stage where it spins up a temporary CowTunnel instance to securely upload large Docker images and build artifacts to an external cloud registry (e.g., AWS ECR or Azure Container Registry). This activity involves the FRP client establishing a reverse proxy to bypass strict outbound firewall rules.
  • Filter/Exclusion: Implement a filter that excludes alerts where the parent process name matches known CI/CD agents (jenkins-agent, gitlab-runner) and the destination port aligns with the artifact registry (e.g., Port 443 or specific FRP ports like 7000-7100).

• Remote Database Migration Tool Execution

  • Scenario: The DBA team utilizes a custom migration script wrapped in an NSS container to synchronize on-premise PostgreSQL databases with a cloud-hosted read-replica. The script initializes the FRP client to create a secure reverse tunnel