Techniques › T1090
T1090 Proxy
command and control — ESXi, Linux, macOS, Network Devices, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
5
analytics
22
Sigma rules tagged attack.t1090
3
KEV CVEs mapped here
<p>Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.</p><p>Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2019-3396 | Atlassian Confluence Server and Data Server | primary impact | Mapped | 2021-11-03 |
| CVE-2021-22986 | F5 BIG-IP and BIG-IQ Centralized Management | primary impact | Mapped | 2021-11-03 |
| CVE-2021-26855 | Microsoft Exchange Server | primary impact | Mapped | 2021-11-03 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0445 Detection of Proxy Infrastructure Setup and Traffic Bridging v1.0
AN1229 WindowsSuspicious process spawning (e.g.,
rundll32,svchost,powershell, ornetsh) followed by network connection creation to internal hosts or uncommon external endpoints on high or non-standard ports.Tunable:ParentProcessNameDestinationPortTimeWindowAN1230 LinuxUser-space tools (e.g.,socat,ncat,iptables,ssh) used in non-standard ways to establish reverse shells, port-forwarding, or inter-host connections. Often chained with uncommon outbound destinations or SSH tunnels.Tunable:CommandLinePatternOutboundPortRangeProcessUserContextAN1231 macOSAppleScript, LaunchAgents, or remote login services (ssh,networksetup) establishing proxy tunnels or dynamic port forwards to external IPs or alternate local hosts.Tunable:TargetDomainAppleScriptUsageLaunchAgentSourceAN1232 ESXiDirect use ofnc,socat, or reverse tunnel scripts initiated by abnormal user contexts or unauthorized VIBs initiating connections from hypervisor to external systems.Tunable:CLICommandDestinationIPUserContextAN1233 Network DevicesDynamic or static port forwarding rules added to route traffic through an internal host, or configuration changes to proxy firewall rules not aligned with baselined policy.Tunable:RuleTypeChangeUserFlowVolumeDelta
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1090
Author: Florian Roth (Nextron Systems)
· 2022-11-03 · logsource: product=linux category=network_connection · 19bf6fdb-7721-4f3d-867f-53467f6a5db6
Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors
Author: Florian Roth (Nextron Systems)
· 2022-11-03 (modified 2024-02-02) · logsource: product=windows category=network_connection · 1d08ac94-400d-4469-a82f-daee9a908849
Detects an executable initiating a network connection to "ngrok" tunneling domains.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Author: Florian Roth (Nextron Systems), omkar72, oscd.community, Swachchhanda Shrawan Poudel
· 2019-01-29 (modified 2023-09-01) · logsource: product=windows category=process_creation · 322ed9ec-fcab-4f67-9a34-e7c6aef43614
Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule
Author: frack113, Florian Roth
· 2022-09-02 (modified 2024-11-23) · logsource: product=windows category=process_creation · 32410e29-5f94-4568-b6a3-d91a8adad863
Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or firewall to the Internet.
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-07 · logsource: product=azure service=riskdetection · 36440e1c-5c22-467a-889b-593e66498472
Indicates sign-in from a malicious IP address known to be malicious at time of sign-in.
Author: Andreas Braathen (mnemonic.io)
· 2024-06-17 · logsource: product=windows category=network_connection · 3ab65069-d82a-4d44-a759-466661a082d1
Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains.
LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet.
Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · 5498fc09-adc6-4804-b9d9-5cca1f0b8760
Detects instances where an HTTPPROXY service on an OpenCanary node has had an attempt to proxy another page.
Author: Muhammad Faisal (@faisalusuf), Hunter Juhan (@threatHNTR)
· 2024-06-03 · logsource: product=windows category=process_creation · 5fc297ae-25b6-488a-8f25-cc12ac29b744
Detects potentially suspicious execution of the Qemu utility in a Windows environment.
Threat actors have leveraged this utility and this technique for achieving network access as reported by Kaspersky.
Author: Florian Roth (Nextron Systems)
· 2022-04-29 · logsource: product=windows service=terminalservices-localsessionmanager · 64d51a51-32a6-49f0-9f3d-17e34d640272
Detects cases in which ngrok, a reverse proxy tool, forwards events to the local RDP port, which could be a sign of malicious behaviour
Author: Florian Roth (Nextron Systems)
· 2022-10-08 (modified 2024-11-23) · logsource: product=windows category=process_creation · 68d37776-61db-42f5-bf54-27e87072d17e
Detects the use of NPS, a port forwarding and intranet penetration proxy server
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-05-17 (modified 2023-12-21) · logsource: product=windows category=process_creation · 7050bba1-1aed-454e-8f73-3f46f09ce56a
Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.
Author: Ömer Günal
· 2020-06-17 (modified 2022-10-05) · logsource: product=linux category=process_creation · 72f4ab3f-787d-495d-a55d-68c2ff46cf4c
Detects setting proxy configuration
Author: Florian Roth (Nextron Systems), oscd.community
· 2019-01-29 (modified 2023-02-13) · logsource: product=windows category=process_creation · 782d6f3e-4c5d-4b8c-92a3-1d05fed72e63
Detects the execution of netsh to configure a port forwarding of port 3389 (RDP) rule
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-03 · logsource: product=azure service=riskdetection · 821b4dc3-1295-41e7-b157-39ab212dd6bd
Indicates sign-ins from IP addresses infected with malware that is known to actively communicate with a bot server.
Author: Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems)
· 2023-05-17 (modified 2023-12-20) · logsource: product=windows category=process_creation · 9a019ffc-3580-4c9d-8d87-079f7e8d3fd4
Detects execution of the "cloudflared" tool to connect back to a tunnel. This was seen used by threat actors to maintain persistence and remote access to compromised networks.
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-07 · logsource: product=azure service=riskdetection · a3f55ebd-0c01-4ed6-adc0-8fb76d8cd3cd
Indicates sign-in from a malicious IP address based on high failure rates.
Author: Andreas Hunkeler (@Karneades)
· 2021-06-22 (modified 2024-03-25) · logsource: product=windows category=registry_event · a54f842a-3713-4b45-8c84-5f136fdebd3c
Detects the modification of the PortProxy registry key which is used for port forwarding.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-07-08 · logsource: product=windows category=ps_script · bd33d2aa-497e-4651-9893-5c5364646595
Detects powershell scripts that creates sockets/listeners which could be indicative of tunneling activity
Author: Andreas Braathen (mnemonic.io)
· 2024-06-17 · logsource: product=linux category=network_connection · c4568f5d-131f-4e78-83d4-45b2da0ec4f1
Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains.
LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet.
Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.
Author: Florian Roth (Nextron Systems)
· 2022-10-08 (modified 2024-11-23) · logsource: product=windows category=process_creation · d7654f02-e04b-4934-9838-65c46f187ebc
Detects the use of IOX - a tool for port forwarding and intranet proxy purposes
Author: Arda Buyukkaya (EclecticIQ)
· 2025-02-11 · logsource: product=windows category=process_creation · e99375eb-3ee0-407a-9f90-79569cc6a01c
Detects the execution of the "curl.exe" command, referencing "SOCKS" and ".onion" domains, which could be indicative of Kalambur backdoor activity.
Author: Florian Roth (Nextron Systems)
· 2022-12-27 (modified 2023-02-04) · logsource: product=windows category=process_creation · f5e3b62f-e577-4e59-931e-0a15b2b94e1e
Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass)