{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1090","id":"T1090","name":"Proxy","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1090","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"c9c0213849e6c66d5a3b834f797b766cedf7eebd64f1647fc8833afa6fd2ef70","description":"Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap.(Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.\n\nAdversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1090","external_id":"T1090"},{"source_name":"Trend Micro APT Attack Tools","description":"Wilhoit, K. (2013, March 4). In-Depth Look: APT Attack Tools of the Trade. Retrieved December 2, 2015.","url":"http://blog.trendmicro.com/trendlabs-security-intelligence/in-depth-look-apt-attack-tools-of-the-trade/"}],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1090.001","id":"T1090.001","name":"Internal Proxy","page":"techniques/enterprise/T1090.001/"},{"key":"enterprise/T1090.002","id":"T1090.002","name":"External Proxy","page":"techniques/enterprise/T1090.002/"},{"key":"enterprise/T1090.003","id":"T1090.003","name":"Multi-hop Proxy","page":"techniques/enterprise/T1090.003/"},{"key":"enterprise/T1090.004","id":"T1090.004","name":"Domain Fronting","page":"techniques/enterprise/T1090.004/"}],"telemetry":[{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0051","name":"Firewall Rule Modification","page":"telemetry/DC0051/","kind":"attack_component","category":"Windows and directory audit","description":"Changes to firewall rules and their matching/action criteria.","collection_focus":"Collect firewall policy audit plus before/after rule snapshots; identify local versus centrally managed policy and the responsible administrator.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["rule_id","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0051","collector":"illustrative-lab-collector","observation":{"rule_id":"lab-rule-1","attribute":"remote_address","before":"192.0.2.10","after":"192.0.2.11"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1090","id":"T1090","name":"Proxy","domain":"enterprise","platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1090","technique_page":"techniques/enterprise/T1090/","page":"detections/enterprise/T1090/","status":"rule_source_available","counts":{"sigma":21,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"sigma_rules":[{"id":"5498fc09-adc6-4804-b9d9-5cca1f0b8760","title":"OpenCanary - HTTPPROXY Login Attempt","status":"test","level":"high","logsource":{"category":"application","product":"opencanary"},"data_path":"data/detection-rules/5498fc09-adc6-4804-b9d9-5cca1f0b8760.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/opencanary/opencanary_httpproxy_login_attempt.yml","author":"Security Onion Solutions","kind":"sigma"},{"id":"a3f55ebd-0c01-4ed6-adc0-8fb76d8cd3cd","title":"Malicious IP Address Sign-In Failure Rate","status":"test","level":"high","logsource":{"product":"azure","service":"riskdetection"},"data_path":"data/detection-rules/a3f55ebd-0c01-4ed6-adc0-8fb76d8cd3cd.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/identity_protection/azure_identity_protection_malicious_ip_address.yml","author":"Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'","kind":"sigma"},{"id":"36440e1c-5c22-467a-889b-593e66498472","title":"Malicious IP Address Sign-In Suspicious","status":"test","level":"high","logsource":{"product":"azure","service":"riskdetection"},"data_path":"data/detection-rules/36440e1c-5c22-467a-889b-593e66498472.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/identity_protection/azure_identity_protection_malicious_ip_address_suspicious.yml","author":"Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'","kind":"sigma"},{"id":"821b4dc3-1295-41e7-b157-39ab212dd6bd","title":"Sign-In From Malware Infected IP","status":"test","level":"high","logsource":{"product":"azure","service":"riskdetection"},"data_path":"data/detection-rules/821b4dc3-1295-41e7-b157-39ab212dd6bd.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/identity_protection/azure_identity_protection_malware_linked_ip.yml","author":"Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'","kind":"sigma"},{"id":"c4568f5d-131f-4e78-83d4-45b2da0ec4f1","title":"Communication To LocaltoNet Tunneling Service Initiated - Linux","status":"test","level":"high","logsource":{"category":"network_connection","product":"linux"},"data_path":"data/detection-rules/c4568f5d-131f-4e78-83d4-45b2da0ec4f1.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/network_connection/net_connection_lnx_domain_localtonet_tunnel.yml","author":"Andreas Braathen (mnemonic.io)","kind":"sigma"},{"id":"19bf6fdb-7721-4f3d-867f-53467f6a5db6","title":"Communication To Ngrok Tunneling Service - Linux","status":"test","level":"high","logsource":{"product":"linux","category":"network_connection"},"data_path":"data/detection-rules/19bf6fdb-7721-4f3d-867f-53467f6a5db6.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/network_connection/net_connection_lnx_ngrok_tunnel.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"72f4ab3f-787d-495d-a55d-68c2ff46cf4c","title":"Connection Proxy","status":"test","level":"low","logsource":{"product":"linux","category":"process_creation"},"data_path":"data/detection-rules/72f4ab3f-787d-495d-a55d-68c2ff46cf4c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_proxy_connection.yml","author":"Ömer Günal","kind":"sigma"},{"id":"64d51a51-32a6-49f0-9f3d-17e34d640272","title":"Ngrok Usage with Remote Desktop Service","status":"test","level":"high","logsource":{"product":"windows","service":"terminalservices-localsessionmanager"},"data_path":"data/detection-rules/64d51a51-32a6-49f0-9f3d-17e34d640272.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/terminalservices/win_terminalservices_rdp_ngrok.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"3ab65069-d82a-4d44-a759-466661a082d1","title":"Communication To LocaltoNet Tunneling Service Initiated","status":"test","level":"high","logsource":{"category":"network_connection","product":"windows"},"data_path":"data/detection-rules/3ab65069-d82a-4d44-a759-466661a082d1.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/network_connection/net_connection_win_domain_localtonet_tunnel.yml","author":"Andreas Braathen (mnemonic.io)","kind":"sigma"},{"id":"1d08ac94-400d-4469-a82f-daee9a908849","title":"Communication To Ngrok Tunneling Service Initiated","status":"test","level":"high","logsource":{"category":"network_connection","product":"windows"},"data_path":"data/detection-rules/1d08ac94-400d-4469-a82f-daee9a908849.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/network_connection/net_connection_win_domain_ngrok_tunnel.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"bd33d2aa-497e-4651-9893-5c5364646595","title":"Suspicious TCP Tunnel Via PowerShell Script","status":"test","level":"medium","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/bd33d2aa-497e-4651-9893-5c5364646595.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_susp_proxy_scripts.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"7050bba1-1aed-454e-8f73-3f46f09ce56a","title":"Cloudflared Tunnel Connections Cleanup","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/7050bba1-1aed-454e-8f73-3f46f09ce56a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_cloudflared_tunnel_cleanup.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"9a019ffc-3580-4c9d-8d87-079f7e8d3fd4","title":"Cloudflared Tunnel Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/9a019ffc-3580-4c9d-8d87-079f7e8d3fd4.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_cloudflared_tunnel_run.yml","author":"Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"f5e3b62f-e577-4e59-931e-0a15b2b94e1e","title":"HackTool - Htran/NATBypass Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/f5e3b62f-e577-4e59-931e-0a15b2b94e1e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_htran_or_natbypass.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"322ed9ec-fcab-4f67-9a34-e7c6aef43614","title":"New Port Forwarding Rule Added Via Netsh.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/322ed9ec-fcab-4f67-9a34-e7c6aef43614.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_netsh_port_forwarding.yml","author":"Florian Roth (Nextron Systems), omkar72, oscd.community, Swachchhanda Shrawan Poudel","kind":"sigma"},{"id":"782d6f3e-4c5d-4b8c-92a3-1d05fed72e63","title":"RDP Port Forwarding Rule Added Via Netsh.EXE","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/782d6f3e-4c5d-4b8c-92a3-1d05fed72e63.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_netsh_port_forwarding_3389.yml","author":"Florian Roth (Nextron Systems), oscd.community","kind":"sigma"},{"id":"32410e29-5f94-4568-b6a3-d91a8adad863","title":"PUA - Fast Reverse Proxy (FRP) Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/32410e29-5f94-4568-b6a3-d91a8adad863.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_frp.yml","author":"frack113, Florian Roth","kind":"sigma"},{"id":"d7654f02-e04b-4934-9838-65c46f187ebc","title":"PUA- IOX Tunneling Tool Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/d7654f02-e04b-4934-9838-65c46f187ebc.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_iox.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"68d37776-61db-42f5-bf54-27e87072d17e","title":"PUA - NPS Tunneling Tool Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/68d37776-61db-42f5-bf54-27e87072d17e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_nps.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"5fc297ae-25b6-488a-8f25-cc12ac29b744","title":"Potentially Suspicious Usage Of Qemu","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/5fc297ae-25b6-488a-8f25-cc12ac29b744.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_qemu_suspicious_execution.yml","author":"Muhammad Faisal (@faisalusuf), Hunter Juhan (@threatHNTR)","kind":"sigma"},{"id":"a54f842a-3713-4b45-8c84-5f136fdebd3c","title":"New PortProxy Registry Entry Added","status":"test","level":"medium","logsource":{"category":"registry_event","product":"windows"},"data_path":"data/detection-rules/a54f842a-3713-4b45-8c84-5f136fdebd3c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_event/registry_event_portproxy_registry_key.yml","author":"Andreas Hunkeler (@Karneades)","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1090-1","technique_id":"T1090","title":"T1090 Proxy","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#command-and-control","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":170,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L170","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"cea42c423bb4aa93448e635c1112a2d075e9f079922681da6fea10c95793c654","validation":"published_concept_not_executable_or_live_validated","logic":"MATCH(proxy_or_tunnel_process_or_configuration) AND actor_or_binary NOT_IN approved_proxy_tools -> ALERT","log_sources":[{"title":"Process Execution Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#6-process-execution-logs"},{"title":"Network Configuration Change Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#75-network-configuration-change-logs"},{"title":"Network Flow Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#57-network-flow-logs"}]}],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0445","name":"Detection of Proxy Infrastructure Setup and Traffic Bridging","url":"https://attack.mitre.org/detectionstrategies/DET0445","stix_id":"x-mitre-detection-strategy--5c44619a-da36-4bbd-9730-efceacf2409f","relationship_id":"relationship--20b8b8ac-5c86-4dc3-a0e7-394f0e1ed7a9","description":"","analytics":[{"id":"AN1229","name":"Analytic 1229","guidance":"Suspicious process spawning (e.g., `rundll32`, `svchost`, `powershell`, or `netsh`) followed by network connection creation to internal hosts or uncommon external endpoints on high or non-standard ports.","url":"https://attack.mitre.org/detectionstrategies/DET0445#AN1229","platforms":["Windows"],"tuning":[{"field":"ParentProcessName","description":"Legitimate system processes that may rarely spawn network-capable child processes (e.g., `rundll32`, `svchost`)."},{"field":"DestinationPort","description":"Watch for high-numbered ports or well-known proxy ports like 1080, 8080, 4444."},{"field":"TimeWindow","description":"Capture unusual spikes in outbound connections over a short period."}],"log_sources":[{"component_id":"DC0082","component":"Network Connection Creation","name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","platforms":["Windows"],"analytic_id":"AN1229","source_url":"https://attack.mitre.org/detectionstrategies/DET0445#AN1229","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"},{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN1229","source_url":"https://attack.mitre.org/detectionstrategies/DET0445#AN1229","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"NSM:Connections","channel":"Outbound Connection","platforms":["Windows"],"analytic_id":"AN1229","source_url":"https://attack.mitre.org/detectionstrategies/DET0445#AN1229","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]},{"id":"AN1230","name":"Analytic 1230","guidance":"User-space tools (e.g., `socat`, `ncat`, `iptables`, `ssh`) used in non-standard ways to establish reverse shells, port-forwarding, or inter-host connections. Often chained with uncommon outbound destinations or SSH tunnels.","url":"https://attack.mitre.org/detectionstrategies/DET0445#AN1230","platforms":["Linux"],"tuning":[{"field":"CommandLinePattern","description":"Shell piping into tools like `socat`, `ncat`, or `openssl` for tunnel creation."},{"field":"OutboundPortRange","description":"Flag connections made from internal systems to uncommon high ports externally."},{"field":"ProcessUserContext","description":"Capture low-privilege or unexpected users executing system-level network tools."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve","platforms":["Linux"],"analytic_id":"AN1230","source_url":"https://attack.mitre.org/detectionstrategies/DET0445#AN1230","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"NSM:Flow","channel":"Connection Tracking","platforms":["Linux"],"analytic_id":"AN1230","source_url":"https://attack.mitre.org/detectionstrategies/DET0445#AN1230","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]},{"id":"AN1231","name":"Analytic 1231","guidance":"AppleScript, LaunchAgents, or remote login services (`ssh`, `networksetup`) establishing proxy tunnels or dynamic port forwards to external IPs or alternate local hosts.","url":"https://attack.mitre.org/detectionstrategies/DET0445#AN1231","platforms":["macOS"],"tuning":[{"field":"TargetDomain","description":"Identify suspicious domains often associated with CDN-routed or anonymized endpoints (e.g., Cloudflare, Fastly)."},{"field":"AppleScriptUsage","description":"Alert when AppleScript or Automator tools are used for network tunneling tasks."},{"field":"LaunchAgentSource","description":"Monitor for LaunchAgents executing proxy tools or dynamic ports."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"None","platforms":["macOS"],"analytic_id":"AN1231","source_url":"https://attack.mitre.org/detectionstrategies/DET0445#AN1231","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"NSM:Firewall","channel":"pf firewall logs","platforms":["macOS"],"analytic_id":"AN1231","source_url":"https://attack.mitre.org/detectionstrategies/DET0445#AN1231","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"NSM:Flow","channel":"connection attempts","platforms":["macOS"],"analytic_id":"AN1231","source_url":"https://attack.mitre.org/detectionstrategies/DET0445#AN1231","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]},{"id":"AN1232","name":"Analytic 1232","guidance":"Direct use of `nc`, `socat`, or reverse tunnel scripts initiated by abnormal user contexts or unauthorized VIBs initiating connections from hypervisor to external systems.","url":"https://attack.mitre.org/detectionstrategies/DET0445#AN1232","platforms":["ESXi"],"tuning":[{"field":"CLICommand","description":"Custom proxy or port forwarding scripts executed from ESXi shell."},{"field":"DestinationIP","description":"Unusual outbound connections from ESXi host, particularly to internet."},{"field":"UserContext","description":"Root or elevated users initiating unexpected tunnels."}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"esxi:shell","channel":"None","platforms":["ESXi"],"analytic_id":"AN1232","source_url":"https://attack.mitre.org/detectionstrategies/DET0445#AN1232","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"esxi:vmkernel","channel":"None","platforms":["ESXi"],"analytic_id":"AN1232","source_url":"https://attack.mitre.org/detectionstrategies/DET0445#AN1232","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"NSM:Flow","channel":"conn.log","platforms":["ESXi"],"analytic_id":"AN1232","source_url":"https://attack.mitre.org/detectionstrategies/DET0445#AN1232","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]},{"id":"AN1233","name":"Analytic 1233","guidance":"Dynamic or static port forwarding rules added to route traffic through an internal host, or configuration changes to proxy firewall rules not aligned with baselined policy.","url":"https://attack.mitre.org/detectionstrategies/DET0445#AN1233","platforms":["Network Devices"],"tuning":[{"field":"RuleType","description":"Focus on new allow/permit rules with dynamic NAT or port forwarders."},{"field":"ChangeUser","description":"Flag any non-admins initiating proxy config changes."},{"field":"FlowVolumeDelta","description":"Detect sharp changes in bi-directional traffic patterns."}],"log_sources":[{"component_id":"DC0051","component":"Firewall Rule Modification","name":"NSM:Firewall","channel":"Policy Change / Rule Update","platforms":["Network Devices"],"analytic_id":"AN1233","source_url":"https://attack.mitre.org/detectionstrategies/DET0445#AN1233","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0051/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"NSM:Flow","channel":"Flow Creation (NetFlow/sFlow)","platforms":["Network Devices"],"analytic_id":"AN1233","source_url":"https://attack.mitre.org/detectionstrategies/DET0445#AN1233","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"},{"component_id":"DC0064","component":"Command Execution","name":"networkdevice:cli","channel":"Interface commands","platforms":["Network Devices"],"analytic_id":"AN1233","source_url":"https://attack.mitre.org/detectionstrategies/DET0445#AN1233","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]}]}],"telemetry_references":[{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0051","name":"Firewall Rule Modification","tag":"Firewall Rule Modification","page":"telemetry/DC0051/","kind":"attack_component"},{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S1144","name":"FRP","page":"tools/S1144/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0040","name":"HTRAN","page":"tools/S0040/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0108","name":"netsh","page":"tools/S0108/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0508","name":"ngrok","page":"tools/S0508/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0378","name":"PoshC2","page":"tools/S0378/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0262","name":"QuasarRAT","page":"tools/S0262/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0332","name":"Remcos","page":"tools/S0332/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S1144","name":"FRP","page":"tools/S1144/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0040","name":"HTRAN","page":"tools/S0040/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0108","name":"netsh","page":"tools/S0108/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0508","name":"ngrok","page":"tools/S0508/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0378","name":"PoshC2","page":"tools/S0378/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0262","name":"QuasarRAT","page":"tools/S0262/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0332","name":"Remcos","page":"tools/S0332/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0040","name":"HTRAN","url":"https://attack.mitre.org/software/S0040","kind":"tool","description":"[HTRAN](https://attack.mitre.org/software/S0040) can proxy TCP socket connections to obfuscate command and control infrastructure.(Citation: Operation Quantum Entanglement)(Citation: NCSC Joint Report Public Tools)","relationship_id":"relationship--1b27cec5-241a-4c2e-a3db-e9cea241496c","references":[{"source_name":"Operation Quantum Entanglement","description":"Haq, T., Moran, N., Vashisht, S., Scott, M. (2014, September). OPERATION QUANTUM ENTANGLEMENT. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20210920193513/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-operation-quantum-entanglement.pdf"},{"source_name":"NCSC Joint Report Public Tools","description":"The Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), the New Zealand National Cyber Security Centre (NZ NCSC), CERT New Zealand, the UK National Cyber Security Centre (UK NCSC) and the US National Cybersecurity and Communications Integration Center (NCCIC). (2018, October 11). Joint report on publicly available hacking tools. Retrieved March 11, 2019.","url":"https://www.ncsc.gov.uk/report/joint-report-on-publicly-available-hacking-tools"}]},{"id":"S0108","name":"netsh","url":"https://attack.mitre.org/software/S0108","kind":"tool","description":"[netsh](https://attack.mitre.org/software/S0108) can be used to set up a proxy tunnel to allow remote host access to an infected host.(Citation: Securelist fileless attacks Feb 2017)","relationship_id":"relationship--69c1806d-e6ae-4c11-bce6-8fbebd8bbee5","references":[{"source_name":"Securelist fileless attacks Feb 2017","description":"Kaspersky Lab's Global Research and Analysis Team. (2017, February 8). Fileless attacks against enterprise networks. Retrieved February 8, 2017.","url":"https://securelist.com/fileless-attacks-against-enterprise-networks/77403/"}]},{"id":"S0117","name":"XTunnel","url":"https://attack.mitre.org/software/S0117","kind":"malware","description":"[XTunnel](https://attack.mitre.org/software/S0117) relays traffic between a C2 server and a victim.(Citation: Crowdstrike DNC June 2016)","relationship_id":"relationship--d3234cf8-0ef7-4447-ae3a-9624f3229265","references":[{"source_name":"Crowdstrike DNC June 2016","description":"Alperovitch, D.. (2016, June 15). Bears in the Midst: Intrusion into the Democratic National Committee. Retrieved August 3, 2016.","url":"https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"}]},{"id":"S0198","name":"NETWIRE","url":"https://attack.mitre.org/software/S0198","kind":"malware","description":"[NETWIRE](https://attack.mitre.org/software/S0198) can implement use of proxies to pivot traffic.(Citation: Red Canary NETWIRE January 2020)","relationship_id":"relationship--060a6b38-18fb-46ac-97c1-b1c40d493b6c","references":[{"source_name":"Red Canary NETWIRE January 2020","description":"Lambert, T. (2020, January 29). Intro to Netwire. Retrieved January 7, 2021.","url":"https://redcanary.com/blog/netwire-remote-access-trojan-on-linux/"}]},{"id":"S0207","name":"Vasport","url":"https://attack.mitre.org/software/S0207","kind":"malware","description":"[Vasport](https://attack.mitre.org/software/S0207) is capable of tunneling though a proxy.(Citation: Symantec Vasport May 2012)","relationship_id":"relationship--b150e3fd-54c0-49ec-a41f-860e92712344","references":[{"source_name":"Symantec Vasport May 2012","description":"Zhou, R. (2012, May 15). Backdoor.Vasport. Retrieved February 22, 2018.","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2012-051606-5938-99"}]},{"id":"S0245","name":"BADCALL","url":"https://attack.mitre.org/software/S0245","kind":"malware","description":"[BADCALL](https://attack.mitre.org/software/S0245) functions as a proxy server between the victim and C2 server.(Citation: US-CERT BADCALL)","relationship_id":"relationship--5f6e76c5-732c-4bc8-9c17-ac1e58a5d88e","references":[{"source_name":"US-CERT BADCALL","description":"US-CERT. (2018, February 06). Malware Analysis Report (MAR) - 10135536-G. Retrieved June 7, 2018.","url":"https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-G.PDF"}]},{"id":"S0246","name":"HARDRAIN","url":"https://attack.mitre.org/software/S0246","kind":"malware","description":"[HARDRAIN](https://attack.mitre.org/software/S0246) uses the command <code>cmd.exe /c netsh firewall add portopening TCP 443 \"adp\"</code> and makes the victim machine function as a proxy server.(Citation: US-CERT HARDRAIN March 2018)","relationship_id":"relationship--74bb0ae9-589c-4479-9bd5-b9a71a20e82d","references":[{"source_name":"US-CERT HARDRAIN March 2018","description":"US-CERT. (2018, February 05). Malware Analysis Report (MAR) - 10135536-F. Retrieved June 11, 2018.","url":"https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-F.pdf"}]},{"id":"S0262","name":"QuasarRAT","url":"https://attack.mitre.org/software/S0262","kind":"tool","description":"[QuasarRAT](https://attack.mitre.org/software/S0262) can communicate over a reverse proxy using SOCKS5.(Citation: GitHub QuasarRAT)(Citation: Volexity Patchwork June 2018)","relationship_id":"relationship--ba218f25-8703-4042-98b0-42afe1c49503","references":[{"source_name":"GitHub QuasarRAT","description":"MaxXor. (n.d.). QuasarRAT. Retrieved July 10, 2018.","url":"https://github.com/quasar/QuasarRAT"},{"source_name":"Volexity Patchwork June 2018","description":"Meltzer, M, et al. (2018, June 07). Patchwork APT Group Targets US Think Tanks. Retrieved July 16, 2018.","url":"https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/"}]},{"id":"S0263","name":"TYPEFRAME","url":"https://attack.mitre.org/software/S0263","kind":"malware","description":"A [TYPEFRAME](https://attack.mitre.org/software/S0263) variant can force the compromised system to function as a proxy server.(Citation: US-CERT TYPEFRAME June 2018)","relationship_id":"relationship--83e001e3-95d3-43d9-9f8c-8b954686287a","references":[{"source_name":"US-CERT TYPEFRAME June 2018","description":"US-CERT. (2018, June 14). MAR-10135536-12 – North Korean Trojan: TYPEFRAME. Retrieved July 13, 2018.","url":"https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"}]},{"id":"S0268","name":"Bisonal","url":"https://attack.mitre.org/software/S0268","kind":"malware","description":"[Bisonal](https://attack.mitre.org/software/S0268) has supported use of a proxy server.(Citation: Talos Bisonal Mar 2020)","relationship_id":"relationship--c8df91dd-3060-4829-93a2-121b85b6c49b","references":[{"source_name":"Talos Bisonal Mar 2020","description":"Mercer, W., et al. (2020, March 5). Bisonal: 10 years of play. Retrieved January 26, 2022.","url":"https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html"}]},{"id":"S0273","name":"Socksbot","url":"https://attack.mitre.org/software/S0273","kind":"malware","description":"[Socksbot](https://attack.mitre.org/software/S0273) can start SOCKS proxy threads.(Citation: TrendMicro Patchwork Dec 2017)","relationship_id":"relationship--a13feeb0-d376-4460-8335-f86c0f163d4b","references":[{"source_name":"TrendMicro Patchwork Dec 2017","description":"Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}]},{"id":"S0283","name":"jRAT","url":"https://attack.mitre.org/software/S0283","kind":"malware","description":"[jRAT](https://attack.mitre.org/software/S0283) can serve as a SOCKS proxy server.(Citation: Kaspersky Adwind Feb 2016)","relationship_id":"relationship--8fd75064-d1b8-4b8c-b9ea-5b65a1cc0ea8","references":[{"source_name":"Kaspersky Adwind Feb 2016","description":"Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07195002/KL_AdwindPublicReport_2016.pdf"}]},{"id":"S0332","name":"Remcos","url":"https://attack.mitre.org/software/S0332","kind":"tool","description":"[Remcos](https://attack.mitre.org/software/S0332) uses the infected hosts as SOCKS5 proxies to allow for tunneling and proxying.(Citation: Riskiq Remcos Jan 2018)(Citation: Fortinet Remcos Campaign NOV 2024)","relationship_id":"relationship--5ed5deda-543f-40f7-8f5d-df8f93c545e2","references":[{"source_name":"Riskiq Remcos Jan 2018","description":"Klijnsma, Y. (2018, January 23). Espionage Campaign Leverages Spear Phishing, RATs Against Turkish Defense Contractors. Retrieved November 6, 2018.","url":"https://web.archive.org/web/20180124082756/https://www.riskiq.com/blog/labs/spear-phishing-turkish-defense-contractors/"},{"source_name":"Fortinet Remcos Campaign NOV 2024","description":"Zhang, X. (2024, November 8). New Campaign Uses Remcos RAT to Exploit Victims. Retrieved April 16, 2026.","url":"https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims"}]},{"id":"S0347","name":"AuditCred","url":"https://attack.mitre.org/software/S0347","kind":"malware","description":"[AuditCred](https://attack.mitre.org/software/S0347) can utilize proxy for communications.(Citation: TrendMicro Lazarus Nov 2018)","relationship_id":"relationship--2485b970-f934-4fdb-80a4-0e11c179845d","references":[{"source_name":"TrendMicro Lazarus Nov 2018","description":"Trend Micro. (2018, November 20). Lazarus Continues Heists, Mounts Attacks on Financial Organizations in Latin America. Retrieved December 3, 2018.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/lazarus-continues-heists-mounts-attacks-on-financial-organizations-in-latin-america/"}]},{"id":"S0348","name":"Cardinal RAT","url":"https://attack.mitre.org/software/S0348","kind":"malware","description":"[Cardinal RAT](https://attack.mitre.org/software/S0348) can act as a reverse proxy.(Citation: PaloAlto CardinalRat Apr 2017)","relationship_id":"relationship--a03d084b-c216-4962-93e8-6c0dc8f0cb91","references":[{"source_name":"PaloAlto CardinalRat Apr 2017","description":"Grunzweig, J.. (2017, April 20). Cardinal RAT Active for Over Two Years. Retrieved December 8, 2018.","url":"https://researchcenter.paloaltonetworks.com/2017/04/unit42-cardinal-rat-active-two-years/"}]},{"id":"S0376","name":"HOPLIGHT","url":"https://attack.mitre.org/software/S0376","kind":"malware","description":"[HOPLIGHT](https://attack.mitre.org/software/S0376) has multiple proxy options that mask traffic between the malware and the remote operators.(Citation: US-CERT HOPLIGHT Apr 2019)\t\n","relationship_id":"relationship--321703ba-7871-46c0-837e-6a2e1dc5aba9","references":[{"source_name":"US-CERT HOPLIGHT Apr 2019","description":"US-CERT. (2019, April 10). MAR-10135536-8 – North Korean Trojan: HOPLIGHT. Retrieved April 19, 2019.","url":"https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"}]},{"id":"S0378","name":"PoshC2","url":"https://attack.mitre.org/software/S0378","kind":"tool","description":"[PoshC2](https://attack.mitre.org/software/S0378) contains modules that allow for use of proxies in command and control.(Citation: GitHub PoshC2)","relationship_id":"relationship--82758a74-b7e2-4839-ad52-bdc6c57c0dba","references":[{"source_name":"GitHub PoshC2","description":"Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.","url":"https://github.com/nettitude/PoshC2_Python"}]},{"id":"S0384","name":"Dridex","url":"https://attack.mitre.org/software/S0384","kind":"malware","description":"[Dridex](https://attack.mitre.org/software/S0384) contains a backconnect module for tunneling network traffic through a victim's computer. Infected computers become part of a P2P botnet that can relay C2 traffic to other infected peers.(Citation: Dell Dridex Oct 2015)(Citation: Checkpoint Dridex Jan 2021) ","relationship_id":"relationship--6f7ee9ba-fb3d-4f22-a78a-8003da718ec4","references":[{"source_name":"Dell Dridex Oct 2015","description":"Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, October 13). Dridex (Bugat v5) Botnet Takeover Operation. Retrieved May 31, 2019.","url":"https://www.secureworks.com/research/dridex-bugat-v5-botnet-takeover-operation"},{"source_name":"Checkpoint Dridex Jan 2021","description":"Check Point Research. (2021, January 4). Stopping Serial Killer: Catching the Next Strike. Retrieved September 7, 2021.","url":"https://research.checkpoint.com/2021/stopping-serial-killer-catching-the-next-strike/"}]},{"id":"S0386","name":"Ursnif","url":"https://attack.mitre.org/software/S0386","kind":"malware","description":"[Ursnif](https://attack.mitre.org/software/S0386) has used a peer-to-peer (P2P) network for C2.(Citation: NJCCIC Ursnif Sept 2016)(Citation: ProofPoint Ursnif Aug 2016)","relationship_id":"relationship--c2bbf923-e30e-4888-894c-7c8ba655c753","references":[{"source_name":"NJCCIC Ursnif Sept 2016","description":"NJCCIC. (2016, September 27). Ursnif. Retrieved September 12, 2024.","url":"https://www.cyber.nj.gov/threat-landscape/malware/trojans/ursnif"},{"source_name":"ProofPoint Ursnif Aug 2016","description":"Proofpoint Staff. (2016, August 25). Nightmare on Tor Street: Ursnif variant Dreambot adds Tor functionality. Retrieved June 5, 2019.","url":"https://www.proofpoint.com/us/threat-insight/post/ursnif-variant-dreambot-adds-tor-functionality"}]},{"id":"S0412","name":"ZxShell","url":"https://attack.mitre.org/software/S0412","kind":"malware","description":"[ZxShell](https://attack.mitre.org/software/S0412) can set up an HTTP or SOCKS proxy.(Citation: FireEye APT41 Aug 2019)(Citation: Talos ZxShell Oct 2014) ","relationship_id":"relationship--2bd05bbf-886e-4211-8aab-63cd8581a695","references":[{"source_name":"Talos ZxShell Oct 2014","description":"Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.","url":"https://blogs.cisco.com/security/talos/opening-zxshell"},{"source_name":"FireEye APT41 Aug 2019","description":"Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"id":"S0435","name":"PLEAD","url":"https://attack.mitre.org/software/S0435","kind":"malware","description":"[PLEAD](https://attack.mitre.org/software/S0435) has the ability to proxy network communications.(Citation: JPCert PLEAD Downloader June 2018)","relationship_id":"relationship--6e23cb4f-61dd-4a6a-8c25-7eb79c376558","references":[{"source_name":"JPCert PLEAD Downloader June 2018","description":"Tomonaga, S. (2018, June 8). PLEAD Downloader Used by BlackTech. Retrieved May 6, 2020.","url":"https://blogs.jpcert.or.jp/en/2018/03/malware-tscooki-7aa0.html"}]},{"id":"S0436","name":"TSCookie","url":"https://attack.mitre.org/software/S0436","kind":"malware","description":"[TSCookie](https://attack.mitre.org/software/S0436) has the ability to proxy communications with command and control (C2) servers.(Citation: JPCert BlackTech Malware September 2019)","relationship_id":"relationship--7c119557-d417-4708-a024-5be9c4d4d86c","references":[{"source_name":"JPCert BlackTech Malware September 2019","description":"Tomonaga, S.. (2019, September 18). Malware Used by BlackTech after Network Intrusion. Retrieved May 6, 2020.","url":"https://blogs.jpcert.or.jp/en/2019/09/tscookie-loader.html"}]},{"id":"S0456","name":"Aria-body","url":"https://attack.mitre.org/software/S0456","kind":"malware","description":"[Aria-body](https://attack.mitre.org/software/S0456) has the ability to use a reverse SOCKS proxy module.(Citation: CheckPoint Naikon May 2020)","relationship_id":"relationship--c7f1b492-eea7-45d1-ab78-6794c7560c67","references":[{"source_name":"CheckPoint Naikon May 2020","description":"CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.","url":"https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/"}]},{"id":"S0461","name":"SDBbot","url":"https://attack.mitre.org/software/S0461","kind":"malware","description":"[SDBbot](https://attack.mitre.org/software/S0461) has the ability to use port forwarding to establish a proxy between a target host and C2.(Citation: Proofpoint TA505 October 2019)","relationship_id":"relationship--1a9510e3-0bb0-4469-bbf8-2d02a3a00d66","references":[{"source_name":"Proofpoint TA505 October 2019","description":"Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader"}]},{"id":"S0487","name":"Kessel","url":"https://attack.mitre.org/software/S0487","kind":"malware","description":"[Kessel](https://attack.mitre.org/software/S0487) can use a proxy during exfiltration if set in the configuration.(Citation: ESET ForSSHe December 2018)","relationship_id":"relationship--75aa57b2-5d2e-49ec-9c26-317b361632c3","references":[{"source_name":"ESET ForSSHe December 2018","description":"Dumont, R., M.Léveillé, M., Porcher, H. (2018, December 1). THE DARK SIDE OF THE FORSSHE A landscape of OpenSSH backdoors. Retrieved July 16, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"}]},{"id":"S0508","name":"ngrok","url":"https://attack.mitre.org/software/S0508","kind":"tool","description":"[ngrok](https://attack.mitre.org/software/S0508) can be used to proxy connections to machines located behind NAT or firewalls.(Citation: MalwareBytes Ngrok February 2020)(Citation: Zdnet Ngrok September 2018)","relationship_id":"relationship--3e16f380-633b-4d27-9249-9bcf25717f5a","references":[{"source_name":"Zdnet Ngrok September 2018","description":"Cimpanu, C. (2018, September 13). Sly malware author hides cryptomining botnet behind ever-shifting proxy service. Retrieved September 15, 2020.","url":"https://www.zdnet.com/article/sly-malware-author-hides-cryptomining-botnet-behind-ever-shifting-proxy-service/"},{"source_name":"MalwareBytes Ngrok February 2020","description":"Segura, J. (2020, February 26). Fraudsters cloak credit card skimmer with fake content delivery network, ngrok server. Retrieved September 15, 2020.","url":"https://blog.malwarebytes.com/threat-analysis/2020/02/fraudsters-cloak-credit-card-skimmer-with-fake-content-delivery-network-ngrok-server/"}]},{"id":"S0615","name":"SombRAT","url":"https://attack.mitre.org/software/S0615","kind":"malware","description":"[SombRAT](https://attack.mitre.org/software/S0615) has the ability to use an embedded SOCKS proxy in C2 communications.(Citation: CISA AR21-126A FIVEHANDS May 2021)","relationship_id":"relationship--1ab94260-498a-4090-85c9-54b89d8b6bb3","references":[{"source_name":"CISA AR21-126A FIVEHANDS May 2021","description":"CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a"}]},{"id":"S0629","name":"RainyDay","url":"https://attack.mitre.org/software/S0629","kind":"malware","description":"[RainyDay](https://attack.mitre.org/software/S0629) can use proxy tools including boost_proxy_client for reverse proxy functionality.(Citation: Bitdefender Naikon April 2021)","relationship_id":"relationship--a01e0e7c-1694-4a6a-8fea-4d4d8a83e034","references":[{"source_name":"Bitdefender Naikon April 2021","description":"Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}]},{"id":"S0669","name":"KOCTOPUS","url":"https://attack.mitre.org/software/S0669","kind":"malware","description":"[KOCTOPUS](https://attack.mitre.org/software/S0669) has deployed a modified version of Invoke-Ngrok to expose open local ports to the Internet.(Citation: MalwareBytes LazyScripter Feb 2021)","relationship_id":"relationship--14ab71d4-a158-41f2-82d4-c70f3121fa11","references":[{"source_name":"MalwareBytes LazyScripter Feb 2021","description":"Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}]},{"id":"S0670","name":"WarzoneRAT","url":"https://attack.mitre.org/software/S0670","kind":"malware","description":"[WarzoneRAT](https://attack.mitre.org/software/S0670) has the capability to act as a reverse proxy.(Citation: Check Point Warzone Feb 2020)","relationship_id":"relationship--384c2ef7-ae14-4ba2-ad86-bfeea3c14f33","references":[{"source_name":"Check Point Warzone Feb 2020","description":"Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.","url":"https://research.checkpoint.com/2020/warzone-behind-the-enemy-lines/"}]},{"id":"S0690","name":"Green Lambert","url":"https://attack.mitre.org/software/S0690","kind":"malware","description":"[Green Lambert](https://attack.mitre.org/software/S0690) can use proxies for C2 traffic.(Citation: Objective See Green Lambert for OSX Oct 2021)(Citation: Glitch-Cat Green Lambert ATTCK Oct 2021)","relationship_id":"relationship--92b8dedc-360a-4763-bc31-5f7b0a698460","references":[{"source_name":"Objective See Green Lambert for OSX Oct 2021","description":"Sandvik, Runa. (2021, October 1). Made In America: Green Lambert for OS X. Retrieved March 21, 2022.","url":"https://objective-see.com/blog/blog_0x68.html"},{"source_name":"Glitch-Cat Green Lambert ATTCK Oct 2021","description":"Sandvik, Runa. (2021, October 18). Green Lambert and ATT&CK. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20211018145402/https://www.glitch-cat.com/blog/green-lambert-and-attack"}]},{"id":"S1044","name":"FunnyDream","url":"https://attack.mitre.org/software/S1044","kind":"malware","description":"[FunnyDream](https://attack.mitre.org/software/S1044) can identify and use configured proxies in a compromised network for C2 communication.(Citation: Bitdefender FunnyDream Campaign November 2020)","relationship_id":"relationship--93900b40-be44-48eb-92bc-c171a5ce5501","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","description":"Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}]},{"id":"S1051","name":"KEYPLUG","url":"https://attack.mitre.org/software/S1051","kind":"malware","description":"[KEYPLUG](https://attack.mitre.org/software/S1051) has used Cloudflare CDN associated infrastructure to redirect C2 communications to malicious domains.(Citation: Mandiant APT41)","relationship_id":"relationship--e55f295e-3531-4f53-bd0e-2c51994d8b44","references":[{"source_name":"Mandiant APT41","description":"Rufus Brown, Van Ta, Douglas Bienstock, Geoff Ackerman, John Wolfram. (2022, March 8). Does This Look Infected? A Summary of APT41 Targeting U.S. State Governments. Retrieved July 8, 2022.","url":"https://www.mandiant.com/resources/apt41-us-state-governments"}]},{"id":"S1081","name":"BADHATCH","url":"https://attack.mitre.org/software/S1081","kind":"malware","description":"[BADHATCH](https://attack.mitre.org/software/S1081) can use SOCKS4 and SOCKS5 proxies to connect to actor-controlled C2 servers. [BADHATCH](https://attack.mitre.org/software/S1081) can also emulate a reverse proxy on a compromised machine to connect with actor-controlled C2 servers.(Citation: BitDefender BADHATCH Mar 2021)","relationship_id":"relationship--62d56cae-9131-4088-ad0a-810a731d2a9f","references":[{"source_name":"BitDefender BADHATCH Mar 2021","description":"Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf"}]},{"id":"S1099","name":"Samurai","url":"https://attack.mitre.org/software/S1099","kind":"malware","description":"[Samurai](https://attack.mitre.org/software/S1099) has the ability to proxy connections to specified remote IPs and ports through a a proxy module.(Citation: Kaspersky ToddyCat June 2022)","relationship_id":"relationship--d8e8d071-fa60-4b6d-a0a4-dc6102f229c8","references":[{"source_name":"Kaspersky ToddyCat June 2022","description":"Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.","url":"https://securelist.com/toddycat/106799/"}]},{"id":"S1114","name":"ZIPLINE","url":"https://attack.mitre.org/software/S1114","kind":"malware","description":"[ZIPLINE](https://attack.mitre.org/software/S1114) can create a proxy server on compromised hosts.(Citation: Mandiant Cutting Edge January 2024)(Citation: Mandiant Cutting Edge Part 2 January 2024)","relationship_id":"relationship--096d97b6-57d0-4722-a204-685fb48ed5ca","references":[{"source_name":"Mandiant Cutting Edge Part 2 January 2024","description":"Lin, M. et al. (2024, January 31). Cutting Edge, Part 2: Investigating Ivanti Connect Secure VPN Zero-Day Exploitation. Retrieved February 27, 2024.","url":"https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation"},{"source_name":"Mandiant Cutting Edge January 2024","description":"McLellan, T. et al. (2024, January 12). Cutting Edge: Suspected APT Targets Ivanti Connect Secure VPN in New Zero-Day Exploitation. Retrieved February 27, 2024.","url":"https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"}]},{"id":"S1121","name":"LITTLELAMB.WOOLTEA","url":"https://attack.mitre.org/software/S1121","kind":"malware","description":"[LITTLELAMB.WOOLTEA](https://attack.mitre.org/software/S1121) has the ability to function as a SOCKS proxy.(Citation: Mandiant Cutting Edge Part 3 February 2024)","relationship_id":"relationship--41fd4cc5-8d62-43f6-833b-1068a8f3003c","references":[{"source_name":"Mandiant Cutting Edge Part 3 February 2024","description":"Lin, M. et al. (2024, February 27). Cutting Edge, Part 3: Investigating Ivanti Connect Secure VPN Exploitation and Persistence Attempts. Retrieved March 1, 2024.","url":"https://www.mandiant.com/resources/blog/investigating-ivanti-exploitation-persistence"}]},{"id":"S1141","name":"LunarWeb","url":"https://attack.mitre.org/software/S1141","kind":"malware","description":"[LunarWeb](https://attack.mitre.org/software/S1141) has the ability to use a HTTP proxy server for C&C communications.(Citation: ESET Turla Lunar toolset May 2024)","relationship_id":"relationship--d403d31c-59d6-42bf-91c5-728e14a3f60c","references":[{"source_name":"ESET Turla Lunar toolset May 2024","description":"Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.","url":"https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"}]},{"id":"S1144","name":"FRP","url":"https://attack.mitre.org/software/S1144","kind":"tool","description":"[FRP](https://attack.mitre.org/software/S1144) can proxy communications through a server in public IP space to local servers located behind a NAT or firewall.(Citation: FRP GitHub)","relationship_id":"relationship--1b885f53-1194-472d-a120-381f000d7b53","references":[{"source_name":"FRP GitHub","description":"fatedier. (n.d.). What is frp?. Retrieved July 10, 2024.","url":"https://github.com/fatedier/frp"}]},{"id":"S1187","name":"reGeorg","url":"https://attack.mitre.org/software/S1187","kind":"malware","description":"[reGeorg](https://attack.mitre.org/software/S1187) can establish an HTTP or SOCKS proxy to tunnel data in and out of a network.(Citation: GitHub reGeorg 2016)(Citation: Fortinet reGeorg MAR 2019)(Citation: Mandiant APT29 Eye Spy Email Nov 22)","relationship_id":"relationship--86bf339d-20a1-45c2-bad8-12b264bc7c5b","references":[{"source_name":"Fortinet reGeorg MAR 2019","description":"FortiGard Labs. (2019, March 12). ReGeorg.HTTP.Tunnel. Retrieved December 3, 2024.","url":"https://www.fortiguard.com/encyclopedia/ips/47584/regeorg-http-tunnel"},{"source_name":"Mandiant APT29 Eye Spy Email Nov 22","description":"Mandiant. (2022, May 2). UNC3524: Eye Spy on Your Email. Retrieved August 17, 2023.","url":"https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"},{"source_name":"GitHub reGeorg 2016","description":"xl7dev. (2016). reGeorg-master. Retrieved December 3, 2024.","url":"https://github.com/xl7dev/WebShell/tree/master/reGeorg-master"}]},{"id":"S1189","name":"Neo-reGeorg","url":"https://attack.mitre.org/software/S1189","kind":"malware","description":"[Neo-reGeorg](https://attack.mitre.org/software/S1189) has the ability to establish a SOCKS5 proxy on a compromised web server.(Citation: GitHub Neo-reGeorg 2019)","relationship_id":"relationship--4f895e31-5953-4d83-bfe0-f1606f3cc83e","references":[{"source_name":"GitHub Neo-reGeorg 2019","description":"L-Codes. (2019). Neo-reGeorg. Retrieved December 4, 2024.","url":"https://github.com/L-codes/Neo-reGeorg/blob/master/README-en.md"}]},{"id":"S1190","name":"Kapeka","url":"https://attack.mitre.org/software/S1190","kind":"malware","description":"[Kapeka](https://attack.mitre.org/software/S1190) can identify system proxy settings via `WinHttpGetIEProxyConfigForCurrentUser()` during initialization and utilize these settings for subsequent command and control operations.(Citation: WithSecure Kapeka 2024)","relationship_id":"relationship--be2fde8e-796c-4647-9351-edd9c97fe2b3","references":[{"source_name":"WithSecure Kapeka 2024","description":"Mohammad Kazem Hassan Nejad, WithSecure. (2024, April 17). KAPEKA A novel backdoor spotted in Eastern Europe. Retrieved January 6, 2025.","url":"https://labs.withsecure.com/content/dam/labs/docs/WithSecure-Research-Kapeka.pdf"}]},{"id":"S1197","name":"GoBear","url":"https://attack.mitre.org/software/S1197","kind":"malware","description":"[GoBear](https://attack.mitre.org/software/S1197) implements SOCKS5 proxy functionality.(Citation: S2W Troll Stealer 2024)","relationship_id":"relationship--660e8d4a-4de9-4566-92d7-0bd7e8e85d19","references":[{"source_name":"S2W Troll Stealer 2024","description":"Jiho Kim & Sebin Lee, S2W. (2024, February 7). Kimsuky disguised as a Korean company signed with a valid certificate to distribute Troll Stealer (English ver.). Retrieved January 17, 2025.","url":"https://medium.com/s2wblog/kimsuky-disguised-as-a-korean-company-signed-with-a-valid-certificate-to-distribute-troll-stealer-cfa5d54314e2"}]},{"id":"S1210","name":"Sagerunex","url":"https://attack.mitre.org/software/S1210","kind":"malware","description":"[Sagerunex](https://attack.mitre.org/software/S1210) uses several proxy configuration settings to ensure connectivity.(Citation: Cisco LotusBlossom 2025)","relationship_id":"relationship--02226352-d8cd-4b84-99bc-2df35f66f37a","references":[{"source_name":"Cisco LotusBlossom 2025","description":"Joey Chen, Cisco Talos. (2025, February 27). Lotus Blossom espionage group targets multiple industries with different versions of Sagerunex and hacking tools. Retrieved March 15, 2025.","url":"https://blog.talosintelligence.com/lotus-blossom-espionage-group/"}]},{"id":"S1212","name":"RansomHub","url":"https://attack.mitre.org/software/S1212","kind":"malware","description":"[RansomHub](https://attack.mitre.org/software/S1212) can use a proxy to connect to remote SFTP servers.(Citation: Group-IB RansomHub FEB 2025)","relationship_id":"relationship--12c19ecc-2d25-45c6-b13b-439220248d4e","references":[{"source_name":"Group-IB RansomHub FEB 2025","description":"Alfano, V. et al. (2025, February 12). RansomHub Never Sleeps Episode 1: The evolution of modern ransomware. Retrieved March 17, 2025.","url":"https://www.group-ib.com/blog/ransomhub-never-sleeps-episode-1/"}]},{"id":"S1229","name":"Havoc","url":"https://attack.mitre.org/software/S1229","kind":"malware","description":"[Havoc](https://attack.mitre.org/software/S1229) has the ability to route HTTP/S communications through designated proxies.(Citation: Havoc Framework Documentation)","relationship_id":"relationship--20b9ce88-4d97-4395-b586-92732080808e","references":[{"source_name":"Havoc Framework Documentation","description":"Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.","url":"https://havocframework.com/docs/welcome"}]},{"id":"S9044","name":"Kali365","url":"https://attack.mitre.org/software/S9044","kind":"malware","description":"[Kali365](https://attack.mitre.org/software/S9044) has leveraged Cloudflare workers as reverse proxy infrastructure.(Citation: Artic Wolf Labs Kali365 Device Code April 2026)(Citation: Huntress Kali365 Device Code June 2026)(Citation: SpyCloud Kali365 June 2026)","relationship_id":"relationship--46ab37b0-4a91-45d3-ac5a-7912494fcf10","references":[{"source_name":"Artic Wolf Labs Kali365 Device Code April 2026","description":"Artic Wolf Labs. (2026, April 24). Token Bingo: Don’t Let Your Code be the Winner. Retrieved July 30, 2026.","url":"https://arcticwolf.com/resources/blog/token-bingo-dont-let-your-code-be-the-winner/"},{"source_name":"Huntress Kali365 Device Code June 2026","description":"Tanner Flip. (2026, June 11). Hook, Line, and Token: Anatomy of the Kali365 / Octopi365 Phishing-as-a-Service Kit. Retrieved July 30, 2026.","url":"https://www.huntress.com/blog/kali365-device-code-phishing-kit"},{"source_name":"SpyCloud Kali365 June 2026","description":"Trevor Hilligoss. (2026, June 11). Kali365: Anatomy of a Microsoft 365 Phishing-as-a-Service Kit – From Telegram Hype to FBI Takedown Theater. Retrieved July 30, 2026.","url":"https://spycloud.com/blog/kali365-anatomy-of-a-microsoft365-phishing-as-a-service-kit/"}]},{"id":"S9051","name":"The Gentlemen Ransomware","url":"https://attack.mitre.org/software/S9051","kind":"malware","description":"[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has utilized SOCKS proxy connections for C2.(Citation: CarveyODonnellWelchHuntress_TheGentlemen_May2026) ","relationship_id":"relationship--ca493dc3-e2ef-45ee-a352-6c7363bc6c57","references":[{"source_name":"CarveyODonnellWelchHuntress_TheGentlemen_May2026","description":"Carvey, H., O'Donnell-Welch, L. (2026, May 21). The Gentlemen (Ransomware) in Disguise: Defense Evasion and other TTPs. Retrieved September 18, 2026.","url":"https://www.huntress.com/blog/the-gentlemen-ransomware-defense-evasion-ttps"}]}],"actors":[{"id":"G0010","name":"Turla","url":"https://attack.mitre.org/groups/G0010","kind":"intrusion-set","description":"[Turla](https://attack.mitre.org/groups/G0010) RPC backdoors have included local UPnP RPC proxies.(Citation: ESET Turla PowerShell May 2019)\t","relationship_id":"relationship--2e162cdf-e917-4bc5-a2d2-1623e05d0b61","references":[{"source_name":"ESET Turla PowerShell May 2019","description":"Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019.","url":"https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"}]},{"id":"G0034","name":"Sandworm Team","url":"https://attack.mitre.org/groups/G0034","kind":"intrusion-set","description":"[Sandworm Team](https://attack.mitre.org/groups/G0034)'s BCS-server tool can create an internal proxy server to redirect traffic from the adversary-controlled C2 to internal servers which may not be connected to the internet, but are interconnected locally.(Citation: ESET Telebots Dec 2016)\t","relationship_id":"relationship--2050b131-d5e1-419c-ad85-660fba4004d7","references":[{"source_name":"ESET Telebots Dec 2016","description":"Cherepanov, A.. (2016, December 13). The rise of TeleBots: Analyzing disruptive KillDisk attacks. Retrieved June 10, 2020.","url":"https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/"}]},{"id":"G0047","name":"Gamaredon Group","url":"https://attack.mitre.org/groups/G0047","kind":"intrusion-set","description":"[Gamaredon Group](https://attack.mitre.org/groups/G0047) has used the Cloudflare Tunnel client to proxy C2 traffic.(Citation: ESET Gamaredon Sept2024)","relationship_id":"relationship--eb8f0f7c-a37f-4c73-8c75-50d650ae5960","references":[{"source_name":"ESET Gamaredon Sept2024","description":"Rusnák, Z. (2024, September 26). Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023. Retrieved October 30, 2024.","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"}]},{"id":"G0052","name":"CopyKittens","url":"https://attack.mitre.org/groups/G0052","kind":"intrusion-set","description":"[CopyKittens](https://attack.mitre.org/groups/G0052) has used the AirVPN service for operational activity.(Citation: Microsoft POLONIUM June 2022)","relationship_id":"relationship--3393682e-22a6-4e27-b890-747f1392741b","references":[{"source_name":"Microsoft POLONIUM June 2022","description":"Microsoft. (2022, June 2). Exposing POLONIUM activity and infrastructure targeting Israeli organizations. Retrieved July 1, 2022.","url":"https://www.microsoft.com/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations/"}]},{"id":"G0059","name":"Magic Hound","url":"https://attack.mitre.org/groups/G0059","kind":"intrusion-set","description":"[Magic Hound](https://attack.mitre.org/groups/G0059) has used Fast Reverse Proxy (FRP) for RDP traffic.(Citation: DFIR Phosphorus November 2021)","relationship_id":"relationship--c1205923-690a-4bfb-9116-0a60eb931b26","references":[{"source_name":"DFIR Phosphorus November 2021","description":"DFIR Report. (2021, November 15). Exchange Exploit Leads to Domain Wide Ransomware. Retrieved January 5, 2023.","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"}]},{"id":"G0069","name":"MuddyWater","url":"https://attack.mitre.org/groups/G0069","kind":"intrusion-set","description":"[MuddyWater](https://attack.mitre.org/groups/G0069) has used NordVPN to proxy phishing emails, making them appear to originate from France.(Citation: FalconFeeds_Iran_Mar2026)   ","relationship_id":"relationship--b3bbe6c1-b715-418f-ae7c-17488948f9b8","references":[{"source_name":"FalconFeeds_Iran_Mar2026","description":"FalconFeeds.io. (2026, March 5). The Digital Redoubt: Iran’s National Information Network and the Asymmetry of Modern Cyber Conflict. Retrieved March 9, 2026.","url":"https://falconfeeds.io/blogs/the-digital-redoubt-irans-national-information-network-cyber-conflict"}]},{"id":"G0096","name":"APT41","url":"https://attack.mitre.org/groups/G0096","kind":"intrusion-set","description":"[APT41](https://attack.mitre.org/groups/G0096) used a tool called CLASSFON to covertly proxy network communications.(Citation: FireEye APT41 Aug 2019)","relationship_id":"relationship--cb0931f7-4d6c-4f21-95a8-fd9d74ba30e0","references":[{"source_name":"FireEye APT41 Aug 2019","description":"Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"id":"G0108","name":"Blue Mockingbird","url":"https://attack.mitre.org/groups/G0108","kind":"intrusion-set","description":"[Blue Mockingbird](https://attack.mitre.org/groups/G0108) has used [FRP](https://attack.mitre.org/software/S1144), ssf, and Venom to establish SOCKS proxy connections.(Citation: RedCanary Mockingbird May 2020)","relationship_id":"relationship--4c26e6e8-8303-44ad-9e5d-452dff52858f","references":[{"source_name":"RedCanary Mockingbird May 2020","description":"Lambert, T. (2020, May 7). Introducing Blue Mockingbird. Retrieved May 26, 2020.","url":"https://redcanary.com/blog/blue-mockingbird-cryptominer/"}]},{"id":"G0117","name":"Fox Kitten","url":"https://attack.mitre.org/groups/G0117","kind":"intrusion-set","description":"[Fox Kitten](https://attack.mitre.org/groups/G0117) has used the open source reverse proxy tools including FRPC and Go Proxy to establish connections from C2 to local servers.(Citation: CISA AA20-259A Iran-Based Actor September 2020)(Citation: ClearSky Pay2Kitten December 2020)(Citation: Check Point Pay2Key November 2020)","relationship_id":"relationship--a637133c-2b07-4e57-8822-5c3bc4b584d7","references":[{"source_name":"CISA AA20-259A Iran-Based Actor September 2020","description":"CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"},{"source_name":"ClearSky Pay2Kitten December 2020","description":"ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.","url":"https://www.clearskysec.com/wp-content/uploads/2020/12/Pay2Kitten.pdf"},{"source_name":"Check Point Pay2Key November 2020","description":"Check Point. (2020, November 6). Ransomware Alert: Pay2Key. Retrieved January 4, 2021.","url":"https://research.checkpoint.com/2020/ransomware-alert-pay2key/"}]},{"id":"G0124","name":"Windigo","url":"https://attack.mitre.org/groups/G0124","kind":"intrusion-set","description":"[Windigo](https://attack.mitre.org/groups/G0124) has delivered a generic Windows proxy Win32/Glubteta.M. [Windigo](https://attack.mitre.org/groups/G0124) has also used multiple reverse proxy chains as part of their C2 infrastructure.(Citation: ESET Windigo Mar 2014)","relationship_id":"relationship--7c776fbc-592a-4643-bd4f-423546a4732e","references":[{"source_name":"ESET Windigo Mar 2014","description":"Bilodeau, O., Bureau, M., Calvet, J., Dorais-Joncas, A., Léveillé, M., Vanheuverzwijn, B. (2014, March 18). Operation Windigo – the vivisection of a large Linux server‑side credential‑stealing malware campaign. Retrieved February 10, 2021.","url":"https://www.welivesecurity.com/2014/03/18/operation-windigo-the-vivisection-of-a-large-linux-server-side-credential-stealing-malware-campaign/"}]},{"id":"G1004","name":"LAPSUS$","url":"https://attack.mitre.org/groups/G1004","kind":"intrusion-set","description":"[LAPSUS$](https://attack.mitre.org/groups/G1004) has leverage NordVPN for its egress points when targeting intended victims.(Citation: MSTIC DEV-0537 Mar 2022)","relationship_id":"relationship--4393f669-4e67-4cd6-a89b-52907138fca7","references":[{"source_name":"MSTIC DEV-0537 Mar 2022","description":"MSTIC, DART, M365 Defender. (2022, March 24). DEV-0537 Criminal Actor Targeting Organizations for Data Exfiltration and Destruction. Retrieved May 17, 2022.","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"id":"G1005","name":"POLONIUM","url":"https://attack.mitre.org/groups/G1005","kind":"intrusion-set","description":"[POLONIUM](https://attack.mitre.org/groups/G1005) has used the AirVPN service for operational activity.(Citation: Microsoft POLONIUM June 2022)","relationship_id":"relationship--81eaf78c-2282-4e86-baa9-820020a54031","references":[{"source_name":"Microsoft POLONIUM June 2022","description":"Microsoft. (2022, June 2). Exposing POLONIUM activity and infrastructure targeting Israeli organizations. Retrieved July 1, 2022.","url":"https://www.microsoft.com/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations/"}]},{"id":"G1006","name":"Earth Lusca","url":"https://attack.mitre.org/groups/G1006","kind":"intrusion-set","description":"[Earth Lusca](https://attack.mitre.org/groups/G1006) adopted Cloudflare as a proxy for compromised servers.(Citation: TrendMicro EarthLusca 2022)","relationship_id":"relationship--bee75401-9e24-4c5d-9203-0b3cdca01cbf","references":[{"source_name":"TrendMicro EarthLusca 2022","description":"Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"id":"G1015","name":"Scattered Spider","url":"https://attack.mitre.org/groups/G1015","kind":"intrusion-set","description":"[Scattered Spider](https://attack.mitre.org/groups/G1015) has used proxy networks to hamper detection and has installed legitimate proxy tools on VMware vCenter and adversary-controlled VMs.(Citation: CrowdStrike Scattered Spider JUL 2025)(Citation: CISA Scattered Spider Advisory November 2023)","relationship_id":"relationship--c00bdbcc-fc8d-4abf-9901-2a5cf291e763","references":[{"source_name":"CrowdStrike Scattered Spider JUL 2025","description":" Counter Adversary Operations. (2025, July 2). CrowdStrike Services Observes SCATTERED SPIDER Escalate Attacks Across Industries. Retrieved October 13, 2025.","url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-services-observes-scattered-spider-escalate-attacks/"},{"source_name":"CISA Scattered Spider Advisory November 2023","description":"CISA. (2023, November 16). Cybersecurity Advisory: Scattered Spider (AA23-320A). Retrieved March 18, 2024.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"}]},{"id":"G1017","name":"Volt Typhoon","url":"https://attack.mitre.org/groups/G1017","kind":"intrusion-set","description":"[Volt Typhoon](https://attack.mitre.org/groups/G1017) has used compromised devices and customized versions of open source tools  such as [FRP](https://attack.mitre.org/software/S1144) (Fast Reverse Proxy), Earthworm, and [Impacket](https://attack.mitre.org/software/S0357) to proxy network traffic.(Citation: Microsoft Volt Typhoon May 2023)(Citation: Joint Cybersecurity Advisory Volt Typhoon June 2023)(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)","relationship_id":"relationship--1542332b-788b-4c1e-b5e5-69d032cb7814","references":[{"source_name":"CISA AA24-038A PRC Critical Infrastructure February 2024","description":"CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"},{"source_name":"Microsoft Volt Typhoon May 2023","description":"Microsoft Threat Intelligence. (2023, May 24). Volt Typhoon targets US critical infrastructure with living-off-the-land techniques. Retrieved July 27, 2023.","url":"https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/"},{"source_name":"Joint Cybersecurity Advisory Volt Typhoon June 2023","description":"NSA et al. (2023, May 24). People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection. Retrieved July 27, 2023.","url":"https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF"}]},{"id":"G1019","name":"MoustachedBouncer","url":"https://attack.mitre.org/groups/G1019","kind":"intrusion-set","description":"[MoustachedBouncer](https://attack.mitre.org/groups/G1019) has used a reverse proxy tool similar to the GitHub repository revsocks.(Citation: MoustachedBouncer ESET August 2023)","relationship_id":"relationship--6abb1f16-7e68-4b0d-a1ae-4001f5a7f87b","references":[{"source_name":"MoustachedBouncer ESET August 2023","description":"Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}]},{"id":"G1021","name":"Cinnamon Tempest","url":"https://attack.mitre.org/groups/G1021","kind":"intrusion-set","description":"[Cinnamon Tempest](https://attack.mitre.org/groups/G1021) has used a customized version of the Iox port-forwarding and proxy tool.(Citation: Sygnia Emperor Dragonfly October 2022)","relationship_id":"relationship--5b68c97c-8eb7-45eb-b2d2-a91bf0fff2a0","references":[{"source_name":"Sygnia Emperor Dragonfly October 2022","description":"Biderman, O. et al. (2022, October 3). REVEALING EMPEROR DRAGONFLY: NIGHT SKY AND CHEERSCRYPT - A SINGLE RANSOMWARE GROUP. Retrieved December 6, 2023.","url":"https://blog.sygnia.co/revealing-emperor-dragonfly-a-chinese-ransomware-group"}]},{"id":"G1045","name":"Salt Typhoon","url":"https://attack.mitre.org/groups/G1045","kind":"intrusion-set","description":"[Salt Typhoon](https://attack.mitre.org/groups/G1045) has utilized virtual private servers and compromised routers as proxies for malicious communications.(Citation: CISA_AA25-239ASaltTyphoon_Sept2025)   ","relationship_id":"relationship--83491142-3547-4944-b208-2a94d8536008","references":[{"source_name":"CISA_AA25-239ASaltTyphoon_Sept2025","description":"CISA. (2025, September 3). Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System. Retrieved September 22, 2026.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a"}]},{"id":"G1052","name":"Contagious Interview","url":"https://attack.mitre.org/groups/G1052","kind":"intrusion-set","description":"[Contagious Interview](https://attack.mitre.org/groups/G1052) has leveraged Astrill VPN for C2.(Citation: Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025)","relationship_id":"relationship--acde21f1-6ece-44c6-89b4-aee4a6cf0ae1","references":[{"source_name":"Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025","description":"Insikt Group. (2025, February 13). Inside the Scam: North Korea’s IT Worker Threat. Retrieved October 17, 2025.","url":"https://www.recordedfuture.com/research/inside-the-scam-north-koreas-it-worker-threat"}]},{"id":"G1054","name":"MirrorFace","url":"https://attack.mitre.org/groups/G1054","kind":"intrusion-set","description":"[MirrorFace](https://attack.mitre.org/groups/G1054) has used the GO Simple Tunnel (GOST) proxy tool.(Citation: JPCERT MirrorFace JUL 2024)","relationship_id":"relationship--3504541e-cfcf-4b92-9de1-d34f1e814d40","references":[{"source_name":"JPCERT MirrorFace JUL 2024","description":"Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"}]}],"mitigations":[{"id":"M1020","name":"SSL/TLS Inspection","url":"https://attack.mitre.org/mitigations/M1020","kind":"course-of-action","description":"If it is possible to inspect HTTPS traffic, the captures can be analyzed for connections that appear to be domain fronting.","relationship_id":"relationship--f229e2fb-3105-4ae5-abe1-d100209f702c","references":[]},{"id":"M1031","name":"Network Intrusion Prevention","url":"https://attack.mitre.org/mitigations/M1031","kind":"course-of-action","description":"Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific C2 protocol used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. (Citation: University of Birmingham C2)","relationship_id":"relationship--d50b5687-ea69-40f9-86f3-eecd7e015bac","references":[{"source_name":"University of Birmingham C2","description":"Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.","url":"https://arxiv.org/pdf/1408.1136"}]},{"id":"M1037","name":"Filter Network Traffic","url":"https://attack.mitre.org/mitigations/M1037","kind":"course-of-action","description":"Traffic to known anonymity networks and C2 infrastructure can be blocked through the use of network allow and block lists. It should be noted that this kind of blocking may be circumvented by other techniques like [Domain Fronting](https://attack.mitre.org/techniques/T1090/004).","relationship_id":"relationship--a424a85c-a3c6-4d84-85f7-e55c8dbe21fc","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1090":"/ttp-simulation/techniques/enterprise/T1090/","T1090.004":"/ttp-simulation/techniques/enterprise/T1090.004/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1090","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0051","collector":"illustrative-lab-collector","observation":{"rule_id":"lab-rule-1","attribute":"remote_address","before":"192.0.2.10","after":"192.0.2.11"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}