Detects execution of the socat utility configured as a TCP/OpenSSL listener that binds an executable to inbound connections. Socat is a legitimate network tool, but this pattern can enable bind shells, remote command execution, or lateral movement by forwarding traffic to a file or process. The rule relies on endpoint data sources (osquery results and Sysmon on Linux) to identify socat processes with arguments indicating execution and listening behavior. The detection looks for socat processes with patterns like exec:* and *-listen:* and correlates them to the destination host, original file name, and user context to produce a targeted alert. It flags MacOS endpoints by combining MacOS-specific osquery data with cross-platform process information. MITRE mappings reference command/scripting interpreter (T1059) and related execution techniques (T1572). The finding highlights that socat was launched to pass inbound connections to a specific process on a given endpoint by a user, enabling rapid investigation and containment actions.