A raw socket is a low-level networking interface that lets software read or create packets with much more control than a normal TCP or UDP socket. Instead of working only with application data, it can expose packet headers and, in some cases, let a process craft packets directly. On Windows, this capability is often restricted and may require elevated privileges.
In cyber security, raw sockets matter because they can be used for packet sniffing, network scanning, and protocol abuse. Malware may use them for stealthy activation, trigger-based communication, or custom packet handling that avoids ordinary application-layer logging. Defenders care because raw-socket activity can indicate reconnaissance or covert control channels, but it can also appear in legitimate tools such as diagnostics and monitoring software. Good detection usually combines privilege monitoring, endpoint telemetry, and attention to unusual packet inspection behavior.