socat

Linux execution T1059

Multipurpose relay tool. More powerful than netcat — supports SSL, UDP, and complex socket operations. Commonly used for encrypted reverse shells and port forwarding.

Binary Paths

  • /usr/bin/socat
  • /usr/local/bin/socat

Glob Patterns

Pattern Notes
soca?
Wildcard replaces 't'
s*t
Star matches 'oca'
so[c]at
Bracket class on third char
s?cat
Wildcard replaces 'o'
soc[a]t
Bracket class on fourth char
/usr/bin/soca?
Full path wildcard
/???/bin/s*t
Full path mixed wildcards
s?c*t
Multiple wildcards in command

Pattern Tester

$

Try typing socat or a full path like /usr/bin/socat

YARA Rule

Auto-generated detection rule for socat

      

Resources

← Previous sed Catalog Next → ssh