Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Medusa – RevSocks/FRP/Ligolo Reverse Tunnel for Covert C2

Medusa Command and Control Sentinel
MITRE ATT&CK
Protocol Tunneling
Data Source
DeviceProcessEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group_tools dataset (medusa)
What This Detects
Beyond its Safe-Mode/service-stop defense-evasion chain, Medusa maintains covert C2 by tunneling through RevSocks, FRP or Ligolo — a broader set of reverse-tunneling tools than the single-tool patterns seen in most other families.
Query
DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName has_any ("revsocks","frpc.exe","frps.exe","ligolo")
| project Timestamp, DeviceName, FileName, ProcessCommandLine, AccountName

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.