If you see an unexpected process named knaben on your server, do not assume it is benign. Check listening ports ( netstat -tulpn | grep knaben ) and outbound connections.
Knaben is a widely known proxy service, often utilized by students and users in restricted network environments (such as schools or workplaces) to bypass web filters and access blocked content. It functions as a "web proxy," acting as an intermediary between the user and the internet. knaben proxy
Threat intelligence feeds (e.g., Abuse.ch, AlienVault OTX) have flagged binaries named knaben_proxy.exe or knaben_srv being dropped by: If you see an unexpected process named knaben