{"id":18538,"date":"2021-01-06T15:37:39","date_gmt":"2021-01-06T12:37:39","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=18538"},"modified":"2026-03-27T20:10:38","modified_gmt":"2026-03-27T17:10:38","slug":"using-proxy-logs-to-detect-suspicious-activity-interview-with-aaron-hambleton","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/using-proxy-logs-to-detect-suspicious-activity-interview-with-aaron-hambleton\/","title":{"rendered":"Using Proxy Logs to Detect Suspicious Activity – Interview with Aaron Hambleton"},"content":{"rendered":"\n

The job of a Proxy is to provide a gateway between the users and the internet. A good quality, well-configured Proxy helps keep users and the internal network protected from the nefarious content published and accessible on the internet.<\/p>\n\n\n\n

\u2018If you\u2019re like most people, you probably associate proxy servers with unblocking Netflix content from other countries or staying a bit more secure on an open WiFi network. The reality, however, is that proxy servers do much more \u2014 and are especially vital for businesses<\/u><\/a>.\u2019 \u2013 RJ Prego (CMSWire)<\/p>\n\n\n\n

All network traffic flowing out of the network should be passing through a Proxy, and the logs typically provide a rich repository of metadata. This inherently makes Proxy logs a great resource for\u00a0Threat Hunting<\/u><\/a>.<\/p>\n\n\n\n

What Data Can Proxy Logs Give You?<\/h1>\n\n\n\n

Proxy logs contain a lot of valuable data which can be used for detecting suspicious activity. Listed below are some examples of what data can be extracted from the logs, and this list is just the start. <\/p>\n\n\n\n

Destination Host Name<\/strong><\/td>The domain or URL being accessed<\/td><\/tr>
Destination IP<\/strong><\/td>The IP address being accessed <\/td><\/tr>
Destination Port<\/strong><\/td>The network port being accessed<\/td><\/tr>
User Agent<\/strong><\/td>The User Agent used to initiate the traffic (Chrome, Mozilla, Curl)<\/td><\/tr>
Request Method<\/strong><\/td>Was it a GET or POST request?<\/td><\/tr>
Device Action<\/strong><\/td>Did the proxy allow or deny the requested traffic?<\/td><\/tr>
Referrer <\/strong><\/td>Who referred the traffic towards the Destination Host Name?<\/td><\/tr>
Domain\/URL Category<\/strong><\/td>What is the Domain\/URL categorised as? (i.e., Malicious or Business)<\/td><\/tr>
Requested File Name<\/strong><\/td>The requested file name when accessing a website<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Detecting Suspicious Network Traffic with Proxy Logs. Real-Life Example <\/h1>\n\n\n\n

SecurityHQ\u2019s team of security experts\u00a0routinely hunt<\/u><\/a>\u00a0for suspicious and potentially malicious activity in our customer networks.\u00a0<\/p>\n\n\n\n

During a recent investigation, Aaron Hambleton, one of SecurityHQ\u2019s Security Monitoring and Incident Response Leads, identified an unapproved third-party management application installed on a Domain Controller routinely beaconing to a suspicious URL. <\/p>\n\n\n\n

Aaron leads a 24\/7 Security Operation Centre in the Middle East. With 10+ years of experience in cyber security, he has worked in Financial Services, Retail, Insurance, Government, and Telecommunication industries as a security consultant and incident response analyst. <\/p>\n\n\n\n

Aaron is a GIAC certified Defence Analyst with extensive knowledge in Security Blue Teaming, Incident Response, Cyber Security Operations, Cloud Security, and Cyber Security consultancy in an advisory capacity.<\/p>\n\n\n\n

\"Image\"\/<\/figure>\n\n\n\n

Aaron, can you provide some context and analysis of what happened in this example? <\/h2>\n\n\n\n

Aaron<\/strong>: \u201cWell, to start the analysis, I extracted the proxy logs from SIEM. For me, raw data is much easier to manipulate and pivot with. Once I had the logs I wanted to check for any anomalies like strange User Agents, request methods, and potentially suspicious file download requests.<\/p>\n\n\n\n

I will typically focus on the least common events first and then pivot when I find something interesting. <\/p>\n\n\n\n

In this case, I observed that a single Domain Controller was having frequent outbound connections to a suspicious URL with a PowerShell UserAgent. This isn\u2019t normal behavior and given the criticality of the server and the fact that this behavior was observed on no other servers, I decided to dig further.\u201d<\/p>\n\n\n\n

Here you can see the detected Powershell UserAgent initiating the outbound network traffic.<\/p>\n\n\n\n

\"Image\"\/<\/figure>\n\n\n\n

What did you do next? <\/h2>\n\n\n\n

Aaron<\/strong>: \u2018Next, I focused on the Domain Controller itself. I wanted to get an idea of what was happening on this server. Using an\u00a0Endpoint Detection & Response<\/u><\/a>\u00a0(EDR) tool I was able to analyse all PowerShell processes on the Domain Controller which were having outbound network connections towards the IP identified in the Proxy logs. My analysis revealed that PowerShell was being used to call and execute a script in order to initiate the connection.\u201d<\/p>\n\n\n\n

The command line parameters for script execution are shown below. (Sections in black redacted for confidentiality).<\/p>\n\n\n\n

\"Image\"\/<\/figure>\n\n\n\n

What did you do with this information? <\/h2>\n\n\n\n

Aaron<\/strong>: \u201cOnce I had identified the script being used to initiate the outbound connections, I was able to download a copy of it from the server and review the code contained inside. Reviewing scripts and code is an important step in investigating suspicious activity, it really helps as an analyst to understand what a script is attempting to execute\u201d<\/p>\n\n\n\n

Below is a code snippet taken from the script<\/em><\/p>\n\n\n\n

\"Image\"\/<\/figure>\n\n\n\n

For those less proficient in coding, what is noticeable about this? <\/h2>\n\n\n\n

Aaron<\/strong>: \u201cAfter reviewing the script, I noticed that there was a URL defined in a variable named $WebCheck. The URL contains a path to a .txt file. When the script executes, it uses the Invoke-WebRequest PowerShell \u2018cmdlet\u2019 to download the file from the URL defined in the $WebCheckvariable.<\/p>\n\n\n\n

This particular case transpired that I had discovered a third-party administration tool on a Domain Controller that was not part of the organizations’ approved software list. We often refer to these tools as a Potentially Unwanted Program or PUP for short.<\/p>\n\n\n\n

Adversaries have previously demonstrated that they will target third party administration and management tools. In this example, there was a real risk that the genuine file being downloaded by the script could have been replaced with a malicious binary or script, paving the way for a potentially devastating attack.\u201d<\/p>\n\n\n\n

Why are these called \u2018Potentially Unwanted Program\u2019? Surely, elements that flag up as potentially unwanted are all either unwanted or malicious?     <\/h2>\n\n\n\n

Aaron<\/strong>: \u201cGood question. Potentially Unwanted Programs (PUPs) are not malware. \u2018The main difference is that you give consent to download the PUP, even though you might not know about it if you didn\u2019t read the agreements or installation process thoroughly<\/u><\/a>.\u2019 (McAfee)<\/p>\n\n\n\n

Some PUPs can contain spyware including keyloggers, and other software to gather your information. Even if the PUP doesn\u2019t have any malicious content, they can slow down a device by consuming disk space on a device, and it can weaken a device\u2019s security, making it more vulnerable to malware.\u201d<\/p>\n\n\n\n

What do you suggest to organizations wanting to avoid such an event? <\/h2>\n\n\n\n

Aaron<\/strong>: \u201cHaving strict controls in place surrounding software installation on endpoints and servers is the first step in preventing these unwanted applications making their way into an organisation. There are a few basic steps an organisation can take to prevent this:<\/p>\n\n\n\n

  1. Use AppLocker or a similar product to stop unauthorized applications from running within the environment. With AppLocker, you can create rules to allow or deny applications from running based on files’ unique identities and specify which users or groups can run those applications.<\/li>
  2. Restrict the permissions of users to prevent them from installing software without following the correct process.<\/li>
  3. Ensure that you have comprehensive endpoint security\u00a0software that can detect<\/u><\/a>\u00a0PUPs and remove them remotely.<\/li><\/ol>\n\n\n\n

    <\/p>\n","protected":false},"excerpt":{"rendered":"

    The job of a Proxy is to provide a gateway between the users and the internet. A good quality, well-configured Proxy helps keep users and the internal network protected from the nefarious content published and accessible on the internet. \u2018If you\u2019re like most people, you probably associate proxy servers with unblocking Netflix content from other […]<\/p>\n","protected":false},"author":10,"featured_media":18539,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_meta-robots-noindex":"","_et_pb_use_builder":"off","_et_pb_old_content":"","_et_gb_content_width":"","_pr_autopilot_social_copy":"","_yoast_wpseo_opengraph_title":"","_yoast_wpseo_opengraph_description":"","_yoast_wpseo_opengraph_image":"","_yoast_wpseo_opengraph_image_id":0,"_yoast_wpseo_twitter_title":"","_yoast_wpseo_twitter_description":"","_yoast_wpseo_twitter_image":"","_yoast_wpseo_twitter_image_id":0,"_yoast_wpseo_primary_category":439,"_extra_hide_author_box":"","_extra_featured_post":"0","_partner_post_id":0,"footnotes":""},"categories":[439],"tags":[],"class_list":["post-18538","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","et-has-post-format-content","et_post_format-et-post-format-standard"],"yoast_head":"\nproxy logs - Detect Suspicious Activity | Saudi Shopper<\/title>\n<meta name=\"description\" content=\"Learn how proxy logs help detect suspicious activity. Insights from an interview with Aaron Hambleton on securing networks and users.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/saudishopper.com.sa\/en\/using-proxy-logs-to-detect-suspicious-activity-interview-with-aaron-hambleton\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"proxy logs - Detect Suspicious Activity | Saudi Shopper\" \/>\n<meta property=\"og:description\" content=\"Learn how proxy logs help detect suspicious activity. Insights from an interview with Aaron Hambleton on securing networks and users.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/saudishopper.com.sa\/en\/using-proxy-logs-to-detect-suspicious-activity-interview-with-aaron-hambleton\/\" \/>\n<meta property=\"og:site_name\" content=\"Saudishopper\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/SaudiShopper\" \/>\n<meta property=\"article:published_time\" content=\"2021-01-06T12:37:39+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-03-27T17:10:38+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/saudishopper.com.sa\/en\/wp-content\/uploads\/2021\/01\/Using-Proxy-Logs-to-Detect-Suspicious-Activity-Banner-1200x628-1.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"628\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Mohamed Mosaed\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@ssict\" \/>\n<meta name=\"twitter:site\" content=\"@ssict\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Mohamed Mosaed\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/using-proxy-logs-to-detect-suspicious-activity-interview-with-aaron-hambleton\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/using-proxy-logs-to-detect-suspicious-activity-interview-with-aaron-hambleton\\\/\"},\"author\":{\"name\":\"Mohamed Mosaed\",\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/#\\\/schema\\\/person\\\/5fe548d4036e285c8f42cdf056399432\"},\"headline\":\"Using Proxy Logs to Detect Suspicious Activity – Interview with Aaron Hambleton\",\"datePublished\":\"2021-01-06T12:37:39+00:00\",\"dateModified\":\"2026-03-27T17:10:38+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/using-proxy-logs-to-detect-suspicious-activity-interview-with-aaron-hambleton\\\/\"},\"wordCount\":1127,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/using-proxy-logs-to-detect-suspicious-activity-interview-with-aaron-hambleton\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/wp-content\\\/uploads\\\/2021\\\/01\\\/Using-Proxy-Logs-to-Detect-Suspicious-Activity-Banner-1200x628-1.jpg\",\"articleSection\":[\"Cybersecurity\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/using-proxy-logs-to-detect-suspicious-activity-interview-with-aaron-hambleton\\\/#respond\"]}],\"copyrightYear\":\"2021\",\"copyrightHolder\":{\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/using-proxy-logs-to-detect-suspicious-activity-interview-with-aaron-hambleton\\\/\",\"url\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/using-proxy-logs-to-detect-suspicious-activity-interview-with-aaron-hambleton\\\/\",\"name\":\"proxy logs - Detect Suspicious Activity | Saudi Shopper\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/using-proxy-logs-to-detect-suspicious-activity-interview-with-aaron-hambleton\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/using-proxy-logs-to-detect-suspicious-activity-interview-with-aaron-hambleton\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/wp-content\\\/uploads\\\/2021\\\/01\\\/Using-Proxy-Logs-to-Detect-Suspicious-Activity-Banner-1200x628-1.jpg\",\"datePublished\":\"2021-01-06T12:37:39+00:00\",\"dateModified\":\"2026-03-27T17:10:38+00:00\",\"description\":\"Learn how proxy logs help detect suspicious activity. Insights from an interview with Aaron Hambleton on securing networks and users.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/using-proxy-logs-to-detect-suspicious-activity-interview-with-aaron-hambleton\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/using-proxy-logs-to-detect-suspicious-activity-interview-with-aaron-hambleton\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/using-proxy-logs-to-detect-suspicious-activity-interview-with-aaron-hambleton\\\/#primaryimage\",\"url\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/wp-content\\\/uploads\\\/2021\\\/01\\\/Using-Proxy-Logs-to-Detect-Suspicious-Activity-Banner-1200x628-1.jpg\",\"contentUrl\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/wp-content\\\/uploads\\\/2021\\\/01\\\/Using-Proxy-Logs-to-Detect-Suspicious-Activity-Banner-1200x628-1.jpg\",\"width\":1200,\"height\":628,\"caption\":\"Using Proxy Logs to Detect Suspicious Activity Banner 1200x628\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/using-proxy-logs-to-detect-suspicious-activity-interview-with-aaron-hambleton\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Using Proxy Logs to Detect Suspicious Activity – Interview with Aaron Hambleton\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/\",\"name\":\"Saudishopper\",\"description\":\"Saudi ICT Shopper News\",\"publisher\":{\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/#organization\",\"name\":\"Saudi ICT News\",\"alternateName\":\"Saudi ICT Shopper News\",\"url\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/SSTrans.png\",\"contentUrl\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/SSTrans.png\",\"width\":423,\"height\":165,\"caption\":\"Saudi ICT News\"},\"image\":{\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/SaudiShopper\",\"https:\\\/\\\/x.com\\\/ssict\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/#\\\/schema\\\/person\\\/5fe548d4036e285c8f42cdf056399432\",\"name\":\"Mohamed Mosaed\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/296c85262ff2745e244f25d889d8abed1b6edd88b3406e359bb0babb74de8fdb?s=96&d=https%3A%2F%2Fsaudishopper.com.sa%2Fen%2Fwp-content%2Fuploads%2F2020%2F12%2Fcropped-ss-icon--150x150.png&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/296c85262ff2745e244f25d889d8abed1b6edd88b3406e359bb0babb74de8fdb?s=96&d=https%3A%2F%2Fsaudishopper.com.sa%2Fen%2Fwp-content%2Fuploads%2F2020%2F12%2Fcropped-ss-icon--150x150.png&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/296c85262ff2745e244f25d889d8abed1b6edd88b3406e359bb0babb74de8fdb?s=96&d=https%3A%2F%2Fsaudishopper.com.sa%2Fen%2Fwp-content%2Fuploads%2F2020%2F12%2Fcropped-ss-icon--150x150.png&r=g\",\"caption\":\"Mohamed Mosaed\"},\"url\":\"https:\\\/\\\/saudishopper.com.sa\\\/en\\\/author\\\/mmosaed\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"proxy logs - Detect Suspicious Activity | Saudi Shopper","description":"Learn how proxy logs help detect suspicious activity. Insights from an interview with Aaron Hambleton on securing networks and users.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/saudishopper.com.sa\/en\/using-proxy-logs-to-detect-suspicious-activity-interview-with-aaron-hambleton\/","og_locale":"en_US","og_type":"article","og_title":"proxy logs - Detect Suspicious Activity | Saudi Shopper","og_description":"Learn how proxy logs help detect suspicious activity. Insights from an interview with Aaron Hambleton on securing networks and users.","og_url":"https:\/\/saudishopper.com.sa\/en\/using-proxy-logs-to-detect-suspicious-activity-interview-with-aaron-hambleton\/","og_site_name":"Saudishopper","article_publisher":"https:\/\/www.facebook.com\/SaudiShopper","article_published_time":"2021-01-06T12:37:39+00:00","article_modified_time":"2026-03-27T17:10:38+00:00","og_image":[{"width":1200,"height":628,"url":"https:\/\/saudishopper.com.sa\/en\/wp-content\/uploads\/2021\/01\/Using-Proxy-Logs-to-Detect-Suspicious-Activity-Banner-1200x628-1.jpg","type":"image\/jpeg"}],"author":"Mohamed Mosaed","twitter_card":"summary_large_image","twitter_creator":"@ssict","twitter_site":"@ssict","twitter_misc":{"Written by":"Mohamed Mosaed","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/saudishopper.com.sa\/en\/using-proxy-logs-to-detect-suspicious-activity-interview-with-aaron-hambleton\/#article","isPartOf":{"@id":"https:\/\/saudishopper.com.sa\/en\/using-proxy-logs-to-detect-suspicious-activity-interview-with-aaron-hambleton\/"},"author":{"name":"Mohamed Mosaed","@id":"https:\/\/saudishopper.com.sa\/en\/#\/schema\/person\/5fe548d4036e285c8f42cdf056399432"},"headline":"Using Proxy Logs to Detect Suspicious Activity – Interview with Aaron Hambleton","datePublished":"2021-01-06T12:37:39+00:00","dateModified":"2026-03-27T17:10:38+00:00","mainEntityOfPage":{"@id":"https:\/\/saudishopper.com.sa\/en\/using-proxy-logs-to-detect-suspicious-activity-interview-with-aaron-hambleton\/"},"wordCount":1127,"commentCount":0,"publisher":{"@id":"https:\/\/saudishopper.com.sa\/en\/#organization"},"image":{"@id":"https:\/\/saudishopper.com.sa\/en\/using-proxy-logs-to-detect-suspicious-activity-interview-with-aaron-hambleton\/#primaryimage"},"thumbnailUrl":"https:\/\/saudishopper.com.sa\/en\/wp-content\/uploads\/2021\/01\/Using-Proxy-Logs-to-Detect-Suspicious-Activity-Banner-1200x628-1.jpg","articleSection":["Cybersecurity"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/saudishopper.com.sa\/en\/using-proxy-logs-to-detect-suspicious-activity-interview-with-aaron-hambleton\/#respond"]}],"copyrightYear":"2021","copyrightHolder":{"@id":"https:\/\/saudishopper.com.sa\/en\/#organization"}},{"@type":"WebPage","@id":"https:\/\/saudishopper.com.sa\/en\/using-proxy-logs-to-detect-suspicious-activity-interview-with-aaron-hambleton\/","url":"https:\/\/saudishopper.com.sa\/en\/using-proxy-logs-to-detect-suspicious-activity-interview-with-aaron-hambleton\/","name":"proxy logs - Detect Suspicious Activity | Saudi Shopper","isPartOf":{"@id":"https:\/\/saudishopper.com.sa\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/saudishopper.com.sa\/en\/using-proxy-logs-to-detect-suspicious-activity-interview-with-aaron-hambleton\/#primaryimage"},"image":{"@id":"https:\/\/saudishopper.com.sa\/en\/using-proxy-logs-to-detect-suspicious-activity-interview-with-aaron-hambleton\/#primaryimage"},"thumbnailUrl":"https:\/\/saudishopper.com.sa\/en\/wp-content\/uploads\/2021\/01\/Using-Proxy-Logs-to-Detect-Suspicious-Activity-Banner-1200x628-1.jpg","datePublished":"2021-01-06T12:37:39+00:00","dateModified":"2026-03-27T17:10:38+00:00","description":"Learn how proxy logs help detect suspicious activity. Insights from an interview with Aaron Hambleton on securing networks and users.","breadcrumb":{"@id":"https:\/\/saudishopper.com.sa\/en\/using-proxy-logs-to-detect-suspicious-activity-interview-with-aaron-hambleton\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/saudishopper.com.sa\/en\/using-proxy-logs-to-detect-suspicious-activity-interview-with-aaron-hambleton\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/saudishopper.com.sa\/en\/using-proxy-logs-to-detect-suspicious-activity-interview-with-aaron-hambleton\/#primaryimage","url":"https:\/\/saudishopper.com.sa\/en\/wp-content\/uploads\/2021\/01\/Using-Proxy-Logs-to-Detect-Suspicious-Activity-Banner-1200x628-1.jpg","contentUrl":"https:\/\/saudishopper.com.sa\/en\/wp-content\/uploads\/2021\/01\/Using-Proxy-Logs-to-Detect-Suspicious-Activity-Banner-1200x628-1.jpg","width":1200,"height":628,"caption":"Using Proxy Logs to Detect Suspicious Activity Banner 1200x628"},{"@type":"BreadcrumbList","@id":"https:\/\/saudishopper.com.sa\/en\/using-proxy-logs-to-detect-suspicious-activity-interview-with-aaron-hambleton\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/saudishopper.com.sa\/en\/"},{"@type":"ListItem","position":2,"name":"Using Proxy Logs to Detect Suspicious Activity – Interview with Aaron Hambleton"}]},{"@type":"WebSite","@id":"https:\/\/saudishopper.com.sa\/en\/#website","url":"https:\/\/saudishopper.com.sa\/en\/","name":"Saudishopper","description":"Saudi ICT Shopper News","publisher":{"@id":"https:\/\/saudishopper.com.sa\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/saudishopper.com.sa\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/saudishopper.com.sa\/en\/#organization","name":"Saudi ICT News","alternateName":"Saudi ICT Shopper News","url":"https:\/\/saudishopper.com.sa\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/saudishopper.com.sa\/en\/#\/schema\/logo\/image\/","url":"https:\/\/saudishopper.com.sa\/en\/wp-content\/uploads\/2020\/08\/SSTrans.png","contentUrl":"https:\/\/saudishopper.com.sa\/en\/wp-content\/uploads\/2020\/08\/SSTrans.png","width":423,"height":165,"caption":"Saudi ICT News"},"image":{"@id":"https:\/\/saudishopper.com.sa\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/SaudiShopper","https:\/\/x.com\/ssict"]},{"@type":"Person","@id":"https:\/\/saudishopper.com.sa\/en\/#\/schema\/person\/5fe548d4036e285c8f42cdf056399432","name":"Mohamed Mosaed","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/296c85262ff2745e244f25d889d8abed1b6edd88b3406e359bb0babb74de8fdb?s=96&d=https%3A%2F%2Fsaudishopper.com.sa%2Fen%2Fwp-content%2Fuploads%2F2020%2F12%2Fcropped-ss-icon--150x150.png&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/296c85262ff2745e244f25d889d8abed1b6edd88b3406e359bb0babb74de8fdb?s=96&d=https%3A%2F%2Fsaudishopper.com.sa%2Fen%2Fwp-content%2Fuploads%2F2020%2F12%2Fcropped-ss-icon--150x150.png&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/296c85262ff2745e244f25d889d8abed1b6edd88b3406e359bb0babb74de8fdb?s=96&d=https%3A%2F%2Fsaudishopper.com.sa%2Fen%2Fwp-content%2Fuploads%2F2020%2F12%2Fcropped-ss-icon--150x150.png&r=g","caption":"Mohamed Mosaed"},"url":"https:\/\/saudishopper.com.sa\/en\/author\/mmosaed\/"}]}},"_links":{"self":[{"href":"https:\/\/saudishopper.com.sa\/en\/wp-json\/wp\/v2\/posts\/18538","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/saudishopper.com.sa\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/saudishopper.com.sa\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/saudishopper.com.sa\/en\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/saudishopper.com.sa\/en\/wp-json\/wp\/v2\/comments?post=18538"}],"version-history":[{"count":1,"href":"https:\/\/saudishopper.com.sa\/en\/wp-json\/wp\/v2\/posts\/18538\/revisions"}],"predecessor-version":[{"id":67007,"href":"https:\/\/saudishopper.com.sa\/en\/wp-json\/wp\/v2\/posts\/18538\/revisions\/67007"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/saudishopper.com.sa\/en\/wp-json\/wp\/v2\/media\/18539"}],"wp:attachment":[{"href":"https:\/\/saudishopper.com.sa\/en\/wp-json\/wp\/v2\/media?parent=18538"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/saudishopper.com.sa\/en\/wp-json\/wp\/v2\/categories?post=18538"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/saudishopper.com.sa\/en\/wp-json\/wp\/v2\/tags?post=18538"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}