Socat Remote TCP Connection with Local Echo Disabled — Detection Rule
The following analytic detects execution of the socat utility with a remote TCP or OpenSSL connection and local terminal echo disabled. This configuration may be used for interactive terminal sessions, password handling, automation, or network debugging. When observed in an unexpected context, such as execution by an unusual parent process or connection to an untrusted endpoint, it may indicate suspicious remote access activity.