{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1572","id":"T1572","name":"Protocol Tunneling","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1572","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"3a7d31d29694317308896d36f57a935fb95b98ae55e3eb1945e77bc4943f3eaa","description":"Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet. \n\nThere are various means to encapsulate a protocol within another protocol. For example, adversaries may perform SSH tunneling (also known as SSH port forwarding), which involves forwarding arbitrary data over an encrypted SSH tunnel.(Citation: SSH Tunneling)(Citation: Sygnia Abyss Locker 2025) \n\n[Protocol Tunneling](https://attack.mitre.org/techniques/T1572) may also be abused by adversaries during [Dynamic Resolution](https://attack.mitre.org/techniques/T1568). Known as DNS over HTTPS (DoH), queries to resolve C2 infrastructure may be encapsulated within encrypted HTTPS packets.(Citation: BleepingComp Godlua JUL19) \n\nAdversaries may also leverage [Protocol Tunneling](https://attack.mitre.org/techniques/T1572) in conjunction with [Proxy](https://attack.mitre.org/techniques/T1090) and/or [Protocol or Service Impersonation](https://attack.mitre.org/techniques/T1001/003) to further conceal C2 communications and infrastructure. ","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1572","external_id":"T1572"},{"source_name":"Sygnia Abyss Locker 2025","description":"Abigail See, Zhongyuan (Aaron) Hau, Ren Jie Yow, Yoav Mazor, Omer Kidron, and Oren Biderman. (2025, February 4). The Anatomy of Abyss Locker Ransomware Attack. Retrieved April 4, 2025.","url":"https://www.sygnia.co/blog/abyss-locker-ransomware-attack-analysis/"},{"source_name":"University of Birmingham C2","description":"Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.","url":"https://arxiv.org/pdf/1408.1136"},{"source_name":"BleepingComp Godlua JUL19","description":"Gatlan, S. (2019, July 3). New Godlua Malware Evades Traffic Monitoring via DNS over HTTPS. Retrieved March 15, 2020.","url":"https://www.bleepingcomputer.com/news/security/new-godlua-malware-evades-traffic-monitoring-via-dns-over-https/"},{"source_name":"SSH Tunneling","description":"SSH.COM. (n.d.). SSH tunnel. Retrieved March 15, 2020.","url":"https://www.ssh.com/ssh/tunneling"}],"platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1572","id":"T1572","name":"Protocol Tunneling","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1572","technique_page":"techniques/enterprise/T1572/","page":"detections/enterprise/T1572/","status":"rule_source_available","counts":{"sigma":23,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[{"id":"c4568f5d-131f-4e78-83d4-45b2da0ec4f1","title":"Communication To LocaltoNet Tunneling Service Initiated - Linux","status":"test","level":"high","logsource":{"category":"network_connection","product":"linux"},"data_path":"data/detection-rules/c4568f5d-131f-4e78-83d4-45b2da0ec4f1.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/network_connection/net_connection_lnx_domain_localtonet_tunnel.yml","author":"Andreas Braathen (mnemonic.io)","kind":"sigma"},{"id":"19bf6fdb-7721-4f3d-867f-53467f6a5db6","title":"Communication To Ngrok Tunneling Service - Linux","status":"test","level":"high","logsource":{"product":"linux","category":"network_connection"},"data_path":"data/detection-rules/19bf6fdb-7721-4f3d-867f-53467f6a5db6.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/network_connection/net_connection_lnx_ngrok_tunnel.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"a1d9eec5-33b2-4177-8d24-27fe754d0812","title":"Cloudflared Tunnels Related DNS Requests","status":"test","level":"medium","logsource":{"category":"dns_query","product":"windows"},"data_path":"data/detection-rules/a1d9eec5-33b2-4177-8d24-27fe754d0812.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/dns_query/dns_query_win_cloudflared_communication.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b","title":"DNS Query To Devtunnels Domain","status":"test","level":"medium","logsource":{"category":"dns_query","product":"windows"},"data_path":"data/detection-rules/1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/dns_query/dns_query_win_devtunnels_communication.yml","author":"citron_ninja","kind":"sigma"},{"id":"9e02c8ec-02b9-43e8-81eb-34a475ba7965","title":"Network Connection Initiated To BTunnels Domains","status":"test","level":"medium","logsource":{"category":"network_connection","product":"windows"},"data_path":"data/detection-rules/9e02c8ec-02b9-43e8-81eb-34a475ba7965.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/network_connection/net_connection_win_domain_btunnels.yml","author":"Kamran Saifullah","kind":"sigma"},{"id":"7cd1dcdc-6edf-4896-86dc-d1f19ad64903","title":"Network Connection Initiated To Cloudflared Tunnels Domains","status":"test","level":"medium","logsource":{"category":"network_connection","product":"windows"},"data_path":"data/detection-rules/7cd1dcdc-6edf-4896-86dc-d1f19ad64903.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/network_connection/net_connection_win_domain_cloudflared_communication.yml","author":"Kamran Saifullah, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4","title":"Network Connection Initiated To DevTunnels Domain","status":"test","level":"medium","logsource":{"category":"network_connection","product":"windows"},"data_path":"data/detection-rules/9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/network_connection/net_connection_win_domain_devtunnels.yml","author":"Kamran Saifullah","kind":"sigma"},{"id":"3ab65069-d82a-4d44-a759-466661a082d1","title":"Communication To LocaltoNet Tunneling Service Initiated","status":"test","level":"high","logsource":{"category":"network_connection","product":"windows"},"data_path":"data/detection-rules/3ab65069-d82a-4d44-a759-466661a082d1.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/network_connection/net_connection_win_domain_localtonet_tunnel.yml","author":"Andreas Braathen (mnemonic.io)","kind":"sigma"},{"id":"18249279-932f-45e2-b37a-8925f2597670","title":"Process Initiated Network Connection To Ngrok Domain","status":"test","level":"high","logsource":{"category":"network_connection","product":"windows"},"data_path":"data/detection-rules/18249279-932f-45e2-b37a-8925f2597670.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/network_connection/net_connection_win_domain_ngrok.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"1d08ac94-400d-4469-a82f-daee9a908849","title":"Communication To Ngrok Tunneling Service Initiated","status":"test","level":"high","logsource":{"category":"network_connection","product":"windows"},"data_path":"data/detection-rules/1d08ac94-400d-4469-a82f-daee9a908849.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/network_connection/net_connection_win_domain_ngrok_tunnel.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"4b657234-038e-4ad5-997c-4be42340bce4","title":"Network Connection Initiated To Visual Studio Code Tunnels Domain","status":"test","level":"medium","logsource":{"category":"network_connection","product":"windows"},"data_path":"data/detection-rules/4b657234-038e-4ad5-997c-4be42340bce4.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/network_connection/net_connection_win_domain_vscode_tunnel_connection.yml","author":"Kamran Saifullah","kind":"sigma"},{"id":"5f699bc5-5446-4a4a-a0b7-5ef2885a3eb4","title":"RDP Over Reverse SSH Tunnel","status":"test","level":"high","logsource":{"category":"network_connection","product":"windows"},"data_path":"data/detection-rules/5f699bc5-5446-4a4a-a0b7-5ef2885a3eb4.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/network_connection/net_connection_win_rdp_reverse_tunnel.yml","author":"Samir Bousseaden","kind":"sigma"},{"id":"b1e5da3b-ca8e-4adf-915c-9921f3d85481","title":"RDP to HTTP or HTTPS Target Ports","status":"test","level":"high","logsource":{"category":"network_connection","product":"windows"},"data_path":"data/detection-rules/b1e5da3b-ca8e-4adf-915c-9921f3d85481.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/network_connection/net_connection_win_rdp_to_http.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"3ceb2083-a27f-449a-be33-14ec1b7cc973","title":"Silence.EDA Detection","status":"test","level":"critical","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/3ceb2083-a27f-449a-be33-14ec1b7cc973.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_apt_silence_eda.yml","author":"Alina Stepchenkova, Group-IB, oscd.community","kind":"sigma"},{"id":"7050bba1-1aed-454e-8f73-3f46f09ce56a","title":"Cloudflared Tunnel Connections Cleanup","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/7050bba1-1aed-454e-8f73-3f46f09ce56a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_cloudflared_tunnel_cleanup.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"9a019ffc-3580-4c9d-8d87-079f7e8d3fd4","title":"Cloudflared Tunnel Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/9a019ffc-3580-4c9d-8d87-079f7e8d3fd4.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_cloudflared_tunnel_run.yml","author":"Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"48a61b29-389f-4032-b317-b30de6b95314","title":"Suspicious Plink Port Forwarding","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/48a61b29-389f-4032-b317-b30de6b95314.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_plink_port_forwarding.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"f38ce0b9-5e97-4b47-a211-7dc8d8b871da","title":"Potential RDP Tunneling Via Plink","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/f38ce0b9-5e97-4b47-a211-7dc8d8b871da.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_plink_susp_tunneling.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"f38a82d2-fba3-4781-b549-525efbec8506","title":"PUA - 3Proxy Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/f38a82d2-fba3-4781-b549-525efbec8506.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_3proxy_execution.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"ee37eb7c-a4e7-4cd5-8fa4-efa27f1c3f31","title":"PUA - Ngrok Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/ee37eb7c-a4e7-4cd5-8fa4-efa27f1c3f31.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_ngrok.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"5fc297ae-25b6-488a-8f25-cc12ac29b744","title":"Potentially Suspicious Usage Of Qemu","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/5fc297ae-25b6-488a-8f25-cc12ac29b744.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_qemu_suspicious_execution.yml","author":"Muhammad Faisal (@faisalusuf), Hunter Juhan (@threatHNTR)","kind":"sigma"},{"id":"327f48c1-a6db-4eb8-875a-f6981f1b0183","title":"Port Forwarding Activity Via SSH.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/327f48c1-a6db-4eb8-875a-f6981f1b0183.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_ssh_port_forward.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"f7d7ebd5-a016-46e2-9c54-f9932f2d386d","title":"Potential RDP Tunneling Via SSH","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/f7d7ebd5-a016-46e2-9c54-f9932f2d386d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_ssh_rdp_tunneling.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1572-1","technique_id":"T1572","title":"T1572 Protocol Tunneling","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#command-and-control","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":171,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L171","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"6c57df6c26d8a6cae5319851cf7a9a602a3a29342e22aaa6e66ab9475ee64c51","validation":"published_concept_not_executable_or_live_validated","logic":"MATCH(tunneling_protocol_signature OR disallowed_protocol_over_allowed_port) -> ALERT","log_sources":[{"title":"Packet-Capture Data","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#58-packet-capture-data"},{"title":"Network Intrusion Detection Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#61-network-intrusion-detection-logs"},{"title":"Network Metadata Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#59-network-metadata-logs"}]}],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0538","name":"Detection Strategy for Protocol Tunneling accross OS platforms.","url":"https://attack.mitre.org/detectionstrategies/DET0538","stix_id":"x-mitre-detection-strategy--fff8e15e-f7eb-4c07-8b77-8e7ef2eb01b6","relationship_id":"relationship--fab7fca5-a36a-481c-a110-4c2abc2af359","description":"","analytics":[{"id":"AN1483","name":"Analytic 1483","guidance":"Processes such as plink.exe, ssh.exe, or netsh.exe establishing outbound network connections where traffic patterns show encapsulated protocols (e.g., RDP over SSH). Defender observations include anomalous process-to-network relationships, large asymmetric data flows, and port usage mismatches.","url":"https://attack.mitre.org/detectionstrategies/DET0538#AN1483","platforms":["Windows"],"tuning":[{"field":"AllowedTools","description":"Whitelist legitimate tunneling tools (e.g., used by admins)."},{"field":"DataAsymmetryThreshold","description":"Ratio of sent vs received bytes that indicates tunneling activity."},{"field":"TimeWindow","description":"Correlate process creation with network connection within N seconds."}],"log_sources":[{"component_id":"DC0082","component":"Network Connection Creation","name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","platforms":["Windows"],"analytic_id":"AN1483","source_url":"https://attack.mitre.org/detectionstrategies/DET0538#AN1483","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"},{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN1483","source_url":"https://attack.mitre.org/detectionstrategies/DET0538#AN1483","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN1484","name":"Analytic 1484","guidance":"sshd, socat, or custom binaries initiating port forwarding or encapsulating traffic (e.g., RDP, SMB) through SSH or HTTP. Defender sees abnormal connect/bind syscalls, encrypted traffic on ports typically used for non-encrypted services, and outlier traffic volume patterns.","url":"https://attack.mitre.org/detectionstrategies/DET0538#AN1484","platforms":["Linux"],"tuning":[{"field":"ForwardingFlags","description":"Specific sshd config flags indicating port forwarding."},{"field":"ProtocolBaseline","description":"Define expected application protocols by port to catch tunneling mismatches."}],"log_sources":[{"component_id":"DC0082","component":"Network Connection Creation","name":"auditd:SYSCALL","channel":"socket/connect calls showing SSH processes forwarding arbitrary ports","platforms":["Linux"],"analytic_id":"AN1484","source_url":"https://attack.mitre.org/detectionstrategies/DET0538#AN1484","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"},{"component_id":"DC0038","component":"Application Log Content","name":"linux:syslog","channel":"sshd sessions with unusual port forwarding parameters","platforms":["Linux"],"analytic_id":"AN1484","source_url":"https://attack.mitre.org/detectionstrategies/DET0538#AN1484","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0032","component":"Process Creation","name":"linux:osquery","channel":"socat, ssh, or nc processes opening unexpected ports","platforms":["Linux"],"analytic_id":"AN1484","source_url":"https://attack.mitre.org/detectionstrategies/DET0538#AN1484","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN1485","name":"Analytic 1485","guidance":"launchd or user-invoked processes (ssh, socat) encapsulating traffic via SSH tunnels, VPN-style tooling, or DNS-over-HTTPS clients. Defender sees outbound TLS traffic with embedded DNS or RDP payloads.","url":"https://attack.mitre.org/detectionstrategies/DET0538#AN1485","platforms":["macOS"],"tuning":[{"field":"ExpectedDoHResolvers","description":"Known legitimate DoH resolvers used in environment."},{"field":"PayloadEntropyThreshold","description":"Flag excessive randomness in payloads on standard ports."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"process execution of ssh with -L/-R forwarding flags","platforms":["macOS"],"analytic_id":"AN1485","source_url":"https://attack.mitre.org/detectionstrategies/DET0538#AN1485","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"macos:unifiedlog","channel":"encrypted outbound traffic carrying unexpected application data","platforms":["macOS"],"analytic_id":"AN1485","source_url":"https://attack.mitre.org/detectionstrategies/DET0538#AN1485","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]},{"id":"AN1486","name":"Analytic 1486","guidance":"VMware daemons or user processes encapsulating traffic (e.g., guest VMs tunneling via hostd). Defender sees network services inside ESXi creating flows inconsistent with management plane traffic, such as SSH forwarding or DNS-over-HTTPS from management interfaces.","url":"https://attack.mitre.org/detectionstrategies/DET0538#AN1486","platforms":["ESXi"],"tuning":[{"field":"ESXiServiceProfiles","description":"Baseline allowed services and expected ports for ESXi management."}],"log_sources":[{"component_id":"DC0078","component":"Network Traffic Flow","name":"esxi:vpxd","channel":"ESXi processes relaying traffic via SSH or unexpected ports","platforms":["ESXi"],"analytic_id":"AN1486","source_url":"https://attack.mitre.org/detectionstrategies/DET0538#AN1486","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"esxcli:network","channel":"listening sockets bound with non-standard encapsulated protocols","platforms":["ESXi"],"analytic_id":"AN1486","source_url":"https://attack.mitre.org/detectionstrategies/DET0538#AN1486","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S1063","name":"Brute Ratel C4","page":"tools/S1063/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"],"guides":[]},{"id":"S1144","name":"FRP","page":"tools/S1144/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0699","name":"Mythic","page":"tools/S0699/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0508","name":"ngrok","page":"tools/S0508/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S1063","name":"Brute Ratel C4","page":"tools/S1063/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"],"guides":[]},{"id":"S1144","name":"FRP","page":"tools/S1144/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0699","name":"Mythic","page":"tools/S0699/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0508","name":"ngrok","page":"tools/S0508/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0022","name":"Uroburos","url":"https://attack.mitre.org/software/S0022","kind":"malware","description":"[Uroburos](https://attack.mitre.org/software/S0022) has the ability to communicate over custom communications methodologies that ride over common network protocols including raw TCP and UDP sockets, HTTP, SMTP, and DNS.(Citation: Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023)","relationship_id":"relationship--b4645fc7-ed61-46d8-a793-ce0e8e43b64a","references":[{"source_name":"Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023","description":"FBI et al. (2023, May 9). Hunting Russian Intelligence “Snake” Malware. Retrieved June 8, 2023.","url":"https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware_2.pdf"}]},{"id":"S0038","name":"Duqu","url":"https://attack.mitre.org/software/S0038","kind":"malware","description":"[Duqu](https://attack.mitre.org/software/S0038) uses a custom command and control protocol that communicates over commonly used ports, and is frequently encapsulated by application layer protocols.(Citation: Symantec W32.Duqu)","relationship_id":"relationship--48f74ebb-3a7e-4b65-8e87-04d3bfe02914","references":[{"source_name":"Symantec W32.Duqu","description":"Symantec Security Response. (2011, November). W32.Duqu: The precursor to the next Stuxnet. Retrieved September 17, 2015.","url":"https://web.archive.org/web/20111213083345/https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf"}]},{"id":"S0154","name":"Cobalt Strike","url":"https://attack.mitre.org/software/S0154","kind":"malware","description":"[Cobalt Strike](https://attack.mitre.org/software/S0154) uses a custom command and control protocol that is encapsulated in HTTP, HTTPS, or DNS. In addition, it conducts peer-to-peer communication over Windows named pipes encapsulated in the SMB protocol. All protocols use their standard assigned ports.(Citation: cobaltstrike manual)(Citation: Cobalt Strike Manual 4.3 November 2020)","relationship_id":"relationship--b6f52beb-1be0-4607-86a6-977d34fabe54","references":[{"source_name":"cobaltstrike manual","description":"Strategic Cyber LLC. (2017, March 14). Cobalt Strike Manual. Retrieved May 24, 2017.","url":"https://web.archive.org/web/20210825130434/https://cobaltstrike.com/downloads/csmanual38.pdf"},{"source_name":"Cobalt Strike Manual 4.3 November 2020","description":"Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021.","url":"https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf"}]},{"id":"S0173","name":"FLIPSIDE","url":"https://attack.mitre.org/software/S0173","kind":"malware","description":"[FLIPSIDE](https://attack.mitre.org/software/S0173) uses RDP to tunnel traffic from a victim environment.(Citation: Mandiant FIN5 GrrCON Oct 2016)","relationship_id":"relationship--e3b79cfa-6ea8-4e7a-85f8-9862702d466a","references":[{"source_name":"Mandiant FIN5 GrrCON Oct 2016","description":"Bromiley, M. and Lewis, P. (2016, October 7). Attacking the Hospitality and Gaming Industries: Tracking an Attacker Around the World in 7 Years. Retrieved October 6, 2017.","url":"https://www.youtube.com/watch?v=fevGZs0EQu8"}]},{"id":"S0508","name":"ngrok","url":"https://attack.mitre.org/software/S0508","kind":"tool","description":"[ngrok](https://attack.mitre.org/software/S0508) can tunnel RDP and other services securely over internet connections.(Citation: FireEye Maze May 2020)(Citation: Cyware Ngrok May 2019)(Citation: MalwareBytes Ngrok February 2020)(Citation: Trend Micro Ngrok September 2020)","relationship_id":"relationship--ca56b2a6-39a7-4449-9017-fa8ce4285ed5","references":[{"source_name":"Trend Micro Ngrok September 2020","description":"Borja, A. Camba, A. et al (2020, September 14). Analysis of a Convoluted Attack Chain Involving Ngrok. Retrieved September 15, 2020.","url":"https://www.trendmicro.com/en_us/research/20/i/analysis-of-a-convoluted-attack-chain-involving-ngrok.html"},{"source_name":"Cyware Ngrok May 2019","description":"Cyware. (2019, May 29). Cyber attackers leverage tunneling service to drop Lokibot onto victims’ systems. Retrieved September 15, 2020.","url":"https://cyware.com/news/cyber-attackers-leverage-tunneling-service-to-drop-lokibot-onto-victims-systems-6f610e44"},{"source_name":"FireEye Maze May 2020","description":"Kennelly, J., Goody, K., Shilko, J. (2020, May 7). Navigating the MAZE: Tactics, Techniques and Procedures Associated With MAZE Ransomware Incidents. Retrieved May 18, 2020.","url":"https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html"},{"source_name":"MalwareBytes Ngrok February 2020","description":"Segura, J. (2020, February 26). Fraudsters cloak credit card skimmer with fake content delivery network, ngrok server. Retrieved September 15, 2020.","url":"https://blog.malwarebytes.com/threat-analysis/2020/02/fraudsters-cloak-credit-card-skimmer-with-fake-content-delivery-network-ngrok-server/"}]},{"id":"S0604","name":"Industroyer","url":"https://attack.mitre.org/software/S0604","kind":"malware","description":"[Industroyer](https://attack.mitre.org/software/S0604) attempts to perform an HTTP CONNECT via an internal proxy to establish a tunnel.(Citation: Dragos Crashoverride 2017)","relationship_id":"relationship--69a744c7-a971-4e21-b305-335801c539d1","references":[{"source_name":"Dragos Crashoverride 2017","description":"Dragos Inc.. (2017, June 13). CRASHOVERRIDE Analysis of the Threat to Electric Grid Operations. Retrieved December 18, 2020.","url":"https://dragos.com/blog/crashoverride/CrashOverride-01.pdf"}]},{"id":"S0650","name":"QakBot","url":"https://attack.mitre.org/software/S0650","kind":"malware","description":"The [QakBot](https://attack.mitre.org/software/S0650) proxy module can encapsulate SOCKS5 protocol within its own proxy protocol.(Citation: Kaspersky QakBot September 2021)","relationship_id":"relationship--ea904c7f-f3a7-4e47-884f-bc13e38b09c6","references":[{"source_name":"Kaspersky QakBot September 2021","description":"Kuzmenko, A. et al. (2021, September 2). QakBot technical analysis. Retrieved September 27, 2021.","url":"https://securelist.com/qakbot-technical-analysis/103931/"}]},{"id":"S0687","name":"Cyclops Blink","url":"https://attack.mitre.org/software/S0687","kind":"malware","description":"[Cyclops Blink](https://attack.mitre.org/software/S0687) can use DNS over HTTPS (DoH) to resolve C2 nodes.(Citation: Trend Micro Cyclops Blink March 2022)","relationship_id":"relationship--f3b71f03-f6d5-4ae2-a8e8-a6263550e5a5","references":[{"source_name":"Trend Micro Cyclops Blink March 2022","description":"Haquebord, F. et al. (2022, March 17). Cyclops Blink Sets Sights on Asus Routers. Retrieved March 17, 2022.","url":"https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html"}]},{"id":"S0699","name":"Mythic","url":"https://attack.mitre.org/software/S0699","kind":"tool","description":"[Mythic](https://attack.mitre.org/software/S0699) can use SOCKS proxies to tunnel traffic through another protocol.(Citation: Mythc Documentation)","relationship_id":"relationship--d0228817-aba0-46c8-9449-de757f9238ac","references":[{"source_name":"Mythc Documentation","description":"Thomas, C. (n.d.). Mythc Documentation. Retrieved March 25, 2022.","url":"https://docs.mythic-c2.net/"}]},{"id":"S1015","name":"Milan","url":"https://attack.mitre.org/software/S1015","kind":"malware","description":"[Milan](https://attack.mitre.org/software/S1015) can use a custom protocol tunneled through DNS or HTTP.(Citation: Kaspersky Lyceum October 2021)","relationship_id":"relationship--93066a4a-0181-48cb-a2c3-3daa7ae5fefd","references":[{"source_name":"Kaspersky Lyceum October 2021","description":"Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022.","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"}]},{"id":"S1020","name":"Kevin","url":"https://attack.mitre.org/software/S1020","kind":"malware","description":"[Kevin](https://attack.mitre.org/software/S1020) can use a custom protocol tunneled through DNS or HTTP.(Citation: Kaspersky Lyceum October 2021)","relationship_id":"relationship--5ee6a7c8-a9a5-4445-8173-408caab5bcbc","references":[{"source_name":"Kaspersky Lyceum October 2021","description":"Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022.","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"}]},{"id":"S1027","name":"Heyoka Backdoor","url":"https://attack.mitre.org/software/S1027","kind":"malware","description":"[Heyoka Backdoor](https://attack.mitre.org/software/S1027) can use spoofed DNS requests to create a bidirectional tunnel between a compromised host and its C2 servers.(Citation: SentinelOne Aoqin Dragon June 2022)","relationship_id":"relationship--19539764-3fe2-42c1-bf25-9e61c21469b4","references":[{"source_name":"SentinelOne Aoqin Dragon June 2022","description":"Chen, Joey. (2022, June 9). Aoqin Dragon | Newly-Discovered Chinese-linked APT Has Been Quietly Spying On Organizations For 10 Years. Retrieved July 14, 2022.","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"}]},{"id":"S1044","name":"FunnyDream","url":"https://attack.mitre.org/software/S1044","kind":"malware","description":"[FunnyDream](https://attack.mitre.org/software/S1044) can connect to HTTP proxies via TCP to create a tunnel to C2.(Citation: Bitdefender FunnyDream Campaign November 2020)","relationship_id":"relationship--4d7080b8-a3e0-4122-b0c9-c1d9c2ba6890","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","description":"Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}]},{"id":"S1063","name":"Brute Ratel C4","url":"https://attack.mitre.org/software/S1063","kind":"tool","description":"[Brute Ratel C4](https://attack.mitre.org/software/S1063) can use DNS over HTTPS for C2.(Citation: Palo Alto Brute Ratel July 2022)(Citation: Trend Micro Black Basta October 2022)","relationship_id":"relationship--8121e11c-6bd7-4b4a-8072-bb9622e6627c","references":[{"source_name":"Palo Alto Brute Ratel July 2022","description":"Harbison, M. and Renals, P. (2022, July 5). When Pentest Tools Go Brutal: Red-Teaming Tool Being Abused by Malicious Actors. Retrieved February 1, 2023.","url":"https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/"},{"source_name":"Trend Micro Black Basta October 2022","description":"Kenefick, I. et al. (2022, October 12). Black Basta Ransomware Gang Infiltrates Networks via QAKBOT, Brute Ratel, and Cobalt Strike. Retrieved February 6, 2023.","url":"https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html"}]},{"id":"S1141","name":"LunarWeb","url":"https://attack.mitre.org/software/S1141","kind":"malware","description":"[LunarWeb](https://attack.mitre.org/software/S1141) can run a custom binary protocol under HTTPS for C2.(Citation: ESET Turla Lunar toolset May 2024)","relationship_id":"relationship--3a8ff308-9a5d-4b59-8508-157a41323765","references":[{"source_name":"ESET Turla Lunar toolset May 2024","description":"Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.","url":"https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"}]},{"id":"S1144","name":"FRP","url":"https://attack.mitre.org/software/S1144","kind":"tool","description":"[FRP](https://attack.mitre.org/software/S1144) can tunnel SSH and Unix Domain Socket communications over TCP between external nodes and exposed resources behind firewalls or NAT.(Citation: FRP GitHub)","relationship_id":"relationship--6ad38475-9375-4c8e-a15d-1a2f5ec6d4b7","references":[{"source_name":"FRP GitHub","description":"fatedier. (n.d.). What is frp?. Retrieved July 10, 2024.","url":"https://github.com/fatedier/frp"}]},{"id":"S1187","name":"reGeorg","url":"https://attack.mitre.org/software/S1187","kind":"malware","description":"[reGeorg](https://attack.mitre.org/software/S1187) can tunnel TCP sessions including RDP, SSH, and SMB through HTTP.(Citation: Fortinet reGeorg MAR 2019)(Citation: Mandiant APT29 Eye Spy Email Nov 22)(Citation: Cadet Blizzard emerges as novel threat actor)","relationship_id":"relationship--3197ebd2-365b-4537-8627-600defd2044d","references":[{"source_name":"Fortinet reGeorg MAR 2019","description":"FortiGard Labs. (2019, March 12). ReGeorg.HTTP.Tunnel. Retrieved December 3, 2024.","url":"https://www.fortiguard.com/encyclopedia/ips/47584/regeorg-http-tunnel"},{"source_name":"Mandiant APT29 Eye Spy Email Nov 22","description":"Mandiant. (2022, May 2). UNC3524: Eye Spy on Your Email. Retrieved August 17, 2023.","url":"https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"},{"source_name":"Cadet Blizzard emerges as novel threat actor","description":"Microsoft Threat Intelligence. (2023, June 14). Cadet Blizzard emerges as a novel and distinct Russian threat actor. Retrieved July 10, 2023.","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"}]},{"id":"S1189","name":"Neo-reGeorg","url":"https://attack.mitre.org/software/S1189","kind":"malware","description":"[Neo-reGeorg](https://attack.mitre.org/software/S1189) can tunnel data in and out of targeted networks.(Citation: GitHub Neo-reGeorg 2019)","relationship_id":"relationship--06eb54e8-74fb-4e63-b94e-c38dd6a57410","references":[{"source_name":"GitHub Neo-reGeorg 2019","description":"L-Codes. (2019). Neo-reGeorg. Retrieved December 4, 2024.","url":"https://github.com/L-codes/Neo-reGeorg/blob/master/README-en.md"}]},{"id":"S9015","name":"BRICKSTORM","url":"https://attack.mitre.org/software/S9015","kind":"malware","description":"[BRICKSTORM](https://attack.mitre.org/software/S9015) has utilized a SOCKS proxy to tunnel access within the victim network and exfiltrate files from internal shares, code repositories, and other endpoints.(Citation: CrowdStrike BRICKSTORM WARP PANDA UNC5221 December 2025)(Citation: CISA BRICKSTORM UNC5221 AR25-338A February 2026)(Citation: Picus Security BRICKSTORM UNC5221 October 2025)(Citation: Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024)(Citation: NVISO BRICKSTORM April 2025)(Citation: Resecurity UNC5221 BRICKSTORM F5 Big-IP October 2025)(Citation: Google BRICKSTORM September 2025)  [BRICKSTORM](https://attack.mitre.org/software/S9015) has also leveraged Yamux for combining multiple concurrent logical streams over a single a socket.(Citation: CISA BRICKSTORM UNC5221 AR25-338A February 2026)(Citation: NVISO BRICKSTORM April 2025)(Citation: Resecurity UNC5221 BRICKSTORM F5 Big-IP October 2025)","relationship_id":"relationship--867a8718-5f12-42db-8fa7-667d51d868be","references":[{"source_name":"CrowdStrike BRICKSTORM WARP PANDA UNC5221 December 2025","description":"CrowdStrike. (2025, December 4). Unveiling WARP PANDA: A New Sophisticated China-Nexus Adversary. Retrieved April 16, 2026.","url":"https://www.crowdstrike.com/en-us/blog/warp-panda-cloud-threats/"},{"source_name":"CISA BRICKSTORM UNC5221 AR25-338A February 2026","description":"DHS/CISA. (2026, February 11). AR25-338A: BRICKSTORM Backdoor. Retrieved April 16, 2026.","url":"https://www.cisa.gov/news-events/analysis-reports/ar25-338a"},{"source_name":"Picus Security BRICKSTORM UNC5221 October 2025","description":"Huseyin Can Yuceel. (2025, October 1). BRICKSTORM Malware: UNC5221 Targets Tech and Legal Sectors in the United States. Retrieved April 16, 2026.","url":"https://www.picussecurity.com/resource/blog/brickstorm-malware-unc5221-targets-tech-and-legal-sectors-in-the-united-states"},{"source_name":"Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024","description":"Matt Lin, Austin Larsen, John Wolfram, Ashley Pearson, Josh Murchie, Lukasz Lamparski, Joseph Pisano, Ryan Hall, Ron Craft, Shawn Crew, Billy Wong, Tyler McLellan. (2024, April 4). Cutting Edge, Part 4: Ivanti Connect Secure VPN Post-Exploitation Lateral Movement Case Studies. Retrieved April 16, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-post-exploitation-lateral-movement"},{"source_name":"NVISO BRICKSTORM April 2025","description":"NVISO Incident Response. (2025, April 1). BRICKSTORM  Backdoor Analysis: A Persistent Espionage Threat  to European Industries. Retrieved April 16, 2026.","url":"https://blog.nviso.eu/wp-content/uploads/2025/04/NVISO-BRICKSTORM-Report.pdf"},{"source_name":"Resecurity UNC5221 BRICKSTORM F5 Big-IP October 2025","description":"Resecurity Threat Intelligence & Incident Analysis. (2025, October 22). F5 BIG-IP Source Code Leak Tied to State-Linked Campaigns Using BRICKSTORM Backdoor. Retrieved April 16, 2026.","url":"https://www.resecurity.com/blog/article/f5-big-ip-source-code-leak-tied-to-state-linked-campaigns-using-brickstorm-backdoor"},{"source_name":"Google BRICKSTORM September 2025","description":"Sarah Yoder, John Wolfram, Ashley Pearson, Doug Bienstock, Josh Madeley, Josh Murchie, Brad Slaybaugh, Matt Lin, Geoff Carstairs, Austin Larsen. (2025, September 24). Another BRICKSTORM: Stealthy Backdoor Enabling Espionage into Tech and Legal Sectors. Retrieved April 16, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"}]},{"id":"S9023","name":"HiddenFace","url":"https://attack.mitre.org/software/S9023","kind":"malware","description":"[HiddenFace](https://attack.mitre.org/software/S9023) can hide its IP lookup by using DNS over HTTPS (DoH) for C2.(Citation: Trend Micro Earth Kasha Updates APR 2025)","relationship_id":"relationship--e5345f9b-d673-417e-86f4-dd2f1b9b2047","references":[{"source_name":"Trend Micro Earth Kasha Updates APR 2025","description":"Hiroaki, H. (2025, April 30). Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan. Retrieved April 17, 2026.","url":"https://www.trendmicro.com/en_us/research/25/d/earth-kasha-updates-ttps.html"}]},{"id":"S9024","name":"SPAWNCHIMERA","url":"https://attack.mitre.org/software/S9024","kind":"malware","description":"[SPAWNCHIMERA](https://attack.mitre.org/software/S9024) has created SSH tunnels to facilitate C2 communications.(Citation: CISA SPAWNCHIMERA RESURGE February 2026)(Citation: Google UNC5221 Ivanti January 2025)(Citation: Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024)","relationship_id":"relationship--4c637450-dd7b-4f6a-b59d-628d8258e0cd","references":[{"source_name":"CISA SPAWNCHIMERA RESURGE February 2026","description":"DHS/CISA. (2026, February 26). MAR-25993211-r1.v2 Ivanti Connect Secure (RESURGE): AR25-087A. Retrieved April 17, 2026.","url":"https://www.cisa.gov/news-events/analysis-reports/ar25-087a"},{"source_name":"Google UNC5221 Ivanti January 2025","description":"John Wolfram, Josh Murchie, Matt Lin, Daniel Ainsworth, Robert Wallace, Dimiter Andonov, Dhanesh Kizhakkinan, Jacob Thompson. (2025, January 8). Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation. Retrieved April 14, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day"},{"source_name":"Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024","description":"Matt Lin, Austin Larsen, John Wolfram, Ashley Pearson, Josh Murchie, Lukasz Lamparski, Joseph Pisano, Ryan Hall, Ron Craft, Shawn Crew, Billy Wong, Tyler McLellan. (2024, April 4). Cutting Edge, Part 4: Ivanti Connect Secure VPN Post-Exploitation Lateral Movement Case Studies. Retrieved April 16, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-post-exploitation-lateral-movement"}]},{"id":"S9061","name":"LIGHTRAIL","url":"https://attack.mitre.org/software/S9061","kind":"malware","description":"[LIGHTRAIL](https://attack.mitre.org/software/S9061) has used SOCKS4A proxies to tunnel traffic.(Citation: Mandiant_UNC1549_Feb2024) ","relationship_id":"relationship--649e00df-7657-4134-a484-29b327975ed5","references":[{"source_name":"Mandiant_UNC1549_Feb2024","description":"Rozmann, O., et al. (2024, February 27). When Cats Fly: Suspected Iranian Threat Actor UNC1549 Targets Israeli and Middle East Aerospace and Defense Sectors. Retrieved September 28, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/suspected-iranian-unc1549-targets-israel-middle-east"}]}],"actors":[{"id":"G0037","name":"FIN6","url":"https://attack.mitre.org/groups/G0037","kind":"intrusion-set","description":"[FIN6](https://attack.mitre.org/groups/G0037) used the Plink command-line utility to create SSH tunnels to C2 servers.(Citation: FireEye FIN6 April 2016)","relationship_id":"relationship--20c7d1a2-be94-4f58-83a9-7eb9e05c4449","references":[{"source_name":"FireEye FIN6 April 2016","description":"FireEye Threat Intelligence. (2016, April). Follow the Money: Dissecting the Operations of the Cyber Crime Group FIN6. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf"}]},{"id":"G0046","name":"FIN7","url":"https://attack.mitre.org/groups/G0046","kind":"intrusion-set","description":"[FIN7](https://attack.mitre.org/groups/G0046) has tunneled C2 traffic via OpenSSH.(Citation: BlackBerry_FIN7_April2024)  ","relationship_id":"relationship--4c0cf71d-c000-46c5-a232-ea0e41a4b48a","references":[{"source_name":"BlackBerry_FIN7_April2024","description":" The BlackBerry Research and Intelligence Team. (2024, April 17). Threat Group FIN7 Targets the U.S. Automotive Industry. Retrieved May 1, 2025.","url":"https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry"}]},{"id":"G0049","name":"OilRig","url":"https://attack.mitre.org/groups/G0049","kind":"intrusion-set","description":"[OilRig](https://attack.mitre.org/groups/G0049) has used the Plink utility and other tools to create tunnels to C2 servers.(Citation: Unit42 OilRig Playbook 2023)(Citation: FireEye APT34 Webinar Dec 2017)(Citation: FireEye APT34 July 2019)(Citation: Symantec Crambus OCT 2023)","relationship_id":"relationship--b6c44630-d1d0-467c-a84d-83564a3a0639","references":[{"source_name":"FireEye APT34 July 2019","description":"Bromiley, M., et al.. (2019, July 18). Hard Pass: Declining APT34’s Invite to Join Their Professional Network. Retrieved August 26, 2019.","url":"https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html"},{"source_name":"FireEye APT34 Webinar Dec 2017","description":"Davis, S. and Caban, D. (2017, December 19). APT34 - New Targeted Attack in the Middle East. Retrieved December 20, 2017.","url":"https://www.brighttalk.com/webcast/10703/296317/apt34-new-targeted-attack-in-the-middle-east"},{"source_name":"Symantec Crambus OCT 2023","description":"Symantec Threat Hunter Team. (2023, October 19). Crambus: New Campaign Targets Middle Eastern Government. Retrieved November 27, 2024.","url":"https://www.security.com/threat-intelligence/crambus-middle-east-government"},{"source_name":"Unit42 OilRig Playbook 2023","description":"Unit42. (2016, May 1). Evasive Serpens Unit 42 Playbook Viewer. Retrieved February 6, 2023.","url":"https://web.archive.org/web/20230610050742/https://pan-unit42.github.io/playbook_viewer/?pb=evasive-serpens"}]},{"id":"G0059","name":"Magic Hound","url":"https://attack.mitre.org/groups/G0059","kind":"intrusion-set","description":"[Magic Hound](https://attack.mitre.org/groups/G0059) has used Plink to tunnel RDP over SSH.(Citation: DFIR Phosphorus November 2021)","relationship_id":"relationship--19bef554-d625-49f9-a521-c6a8ed773083","references":[{"source_name":"DFIR Phosphorus November 2021","description":"DFIR Report. (2021, November 15). Exchange Exploit Leads to Domain Wide Ransomware. Retrieved January 5, 2023.","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"}]},{"id":"G0065","name":"Leviathan","url":"https://attack.mitre.org/groups/G0065","kind":"intrusion-set","description":"[Leviathan](https://attack.mitre.org/groups/G0065) has used protocol tunneling to further conceal C2 communications and infrastructure.(Citation: CISA AA21-200A APT40 July 2021)","relationship_id":"relationship--f71fa9f5-7a3c-43a7-8ca3-2e3c8996bde8","references":[{"source_name":"CISA AA21-200A APT40 July 2021","description":"CISA. (2021, July 19). (AA21-200A) Joint Cybersecurity Advisory – Tactics, Techniques, and Procedures of Indicted APT40 Actors Associated with China’s MSS Hainan State Security Department. Retrieved August 12, 2021.","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-200a"}]},{"id":"G0080","name":"Cobalt Group","url":"https://attack.mitre.org/groups/G0080","kind":"intrusion-set","description":"[Cobalt Group](https://attack.mitre.org/groups/G0080) has used the Plink utility to create SSH tunnels.(Citation: Talos Cobalt Group July 2018)(Citation: PTSecurity Cobalt Dec 2016)(Citation: Group IB Cobalt Aug 2017)","relationship_id":"relationship--c50f75fe-e7a9-4190-9ca8-a28187955669","references":[{"source_name":"Talos Cobalt Group July 2018","description":"Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.","url":"https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html"},{"source_name":"PTSecurity Cobalt Dec 2016","description":"Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018.","url":"https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-Snatch-eng.pdf"},{"source_name":"Group IB Cobalt Aug 2017","description":"Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.","url":"https://www.group-ib.com/blog/cobalt"}]},{"id":"G0114","name":"Chimera","url":"https://attack.mitre.org/groups/G0114","kind":"intrusion-set","description":"[Chimera](https://attack.mitre.org/groups/G0114) has encapsulated [Cobalt Strike](https://attack.mitre.org/software/S0154)'s C2 protocol in DNS and HTTPS.(Citation: NCC Group Chimera January 2021)","relationship_id":"relationship--8b769a4e-8898-4995-adc1-4334dc0ec0f7","references":[{"source_name":"NCC Group Chimera January 2021","description":"Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024.","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"id":"G0117","name":"Fox Kitten","url":"https://attack.mitre.org/groups/G0117","kind":"intrusion-set","description":"[Fox Kitten](https://attack.mitre.org/groups/G0117) has used protocol tunneling for communication and RDP activity on compromised hosts through the use of open source tools such as [ngrok](https://attack.mitre.org/software/S0508) and custom tool SSHMinion.(Citation: CrowdStrike PIONEER KITTEN August 2020)(Citation: CISA AA20-259A Iran-Based Actor September 2020)(Citation: ClearSky Pay2Kitten December 2020)","relationship_id":"relationship--bdaf3340-0580-4e89-9cdc-e0af5a91ed85","references":[{"source_name":"CrowdStrike PIONEER KITTEN August 2020","description":"Orleans, A. (2020, August 31). Who Is PIONEER KITTEN?. Retrieved December 21, 2020.","url":"https://www.crowdstrike.com/blog/who-is-pioneer-kitten/"},{"source_name":"CISA AA20-259A Iran-Based Actor September 2020","description":"CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"},{"source_name":"ClearSky Pay2Kitten December 2020","description":"ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.","url":"https://www.clearskysec.com/wp-content/uploads/2020/12/Pay2Kitten.pdf"}]},{"id":"G0129","name":"Mustang Panda","url":"https://attack.mitre.org/groups/G0129","kind":"intrusion-set","description":"[Mustang Panda](https://attack.mitre.org/groups/G0129) has leveraged OpenSSH (sshd.exe) to execute commands, transfer files and spread across the environment communicating over SMB port 445.(Citation: Unit42 Chinese VSCode 06 September 2024)","relationship_id":"relationship--e67a8b60-ef9c-484b-91b4-0594a7b60eb2","references":[{"source_name":"Unit42 Chinese VSCode 06 September 2024","description":"Tom Fakterman. (2024, September 6). Chinese APT Abuses VSCode to Target Government in Asia. Retrieved March 24, 2025.","url":"https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/"}]},{"id":"G1003","name":"Ember Bear","url":"https://attack.mitre.org/groups/G1003","kind":"intrusion-set","description":"[Ember Bear](https://attack.mitre.org/groups/G1003) has used ProxyChains to tunnel protocols to internal networks.(Citation: CISA GRU29155 2024)","relationship_id":"relationship--50b91e01-e769-4164-a01e-57951e2e8348","references":[{"source_name":"CISA GRU29155 2024","description":"US Cybersecurity & Infrastructure Security Agency et al. (2024, September 5). Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure. Retrieved September 6, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"id":"G1015","name":"Scattered Spider","url":"https://attack.mitre.org/groups/G1015","kind":"intrusion-set","description":"[Scattered Spider](https://attack.mitre.org/groups/G1015) has installed protocol-tunneling tools on VMware vCenter and adversary-controlled VMs, including Teleport.sh, Chisel (configured to communicate with trycloudflare[.]com subdomains), MobaXterm, ngrok, Pinggy, and Teleport.(Citation: CrowdStrike Scattered Spider JUL 2025)(Citation: CISA Scattered Spider Advisory November 2023)","relationship_id":"relationship--e9f04e42-2c14-406a-9ddf-ce93f91beab7","references":[{"source_name":"CrowdStrike Scattered Spider JUL 2025","description":" Counter Adversary Operations. (2025, July 2). CrowdStrike Services Observes SCATTERED SPIDER Escalate Attacks Across Industries. Retrieved October 13, 2025.","url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-services-observes-scattered-spider-escalate-attacks/"},{"source_name":"CISA Scattered Spider Advisory November 2023","description":"CISA. (2023, November 16). Cybersecurity Advisory: Scattered Spider (AA23-320A). Retrieved March 18, 2024.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"}]},{"id":"G1016","name":"FIN13","url":"https://attack.mitre.org/groups/G1016","kind":"intrusion-set","description":"[FIN13](https://attack.mitre.org/groups/G1016) has utilized web shells and Java tools for tunneling capabilities to and from compromised assets.(Citation: Sygnia Elephant Beetle Jan 2022)","relationship_id":"relationship--0d357a8d-c053-44f0-8777-0e8f8f7bc9a8","references":[{"source_name":"Sygnia Elephant Beetle Jan 2022","description":"Sygnia Incident Response Team. (2022, January 5). TG2003: ELEPHANT BEETLE UNCOVERING AN ORGANIZED FINANCIAL-THEFT OPERATION. Retrieved February 9, 2023.","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"}]},{"id":"G1021","name":"Cinnamon Tempest","url":"https://attack.mitre.org/groups/G1021","kind":"intrusion-set","description":"[Cinnamon Tempest](https://attack.mitre.org/groups/G1021) has used the Iox and NPS proxy and tunneling tools in combination  create multiple connections through a single tunnel.(Citation: Sygnia Emperor Dragonfly October 2022)","relationship_id":"relationship--c8cae681-d480-4b85-ba37-d3d3265c98c2","references":[{"source_name":"Sygnia Emperor Dragonfly October 2022","description":"Biderman, O. et al. (2022, October 3). REVEALING EMPEROR DRAGONFLY: NIGHT SKY AND CHEERSCRYPT - A SINGLE RANSOMWARE GROUP. Retrieved December 6, 2023.","url":"https://blog.sygnia.co/revealing-emperor-dragonfly-a-chinese-ransomware-group"}]},{"id":"G1045","name":"Salt Typhoon","url":"https://attack.mitre.org/groups/G1045","kind":"intrusion-set","description":"[Salt Typhoon](https://attack.mitre.org/groups/G1045) has modified device configurations to create and use Generic Routing Encapsulation (GRE) tunnels.(Citation: Cisco Salt Typhoon FEB 2025)\n","relationship_id":"relationship--28d1f706-c879-4916-8591-dcf475029362","references":[{"source_name":"Cisco Salt Typhoon FEB 2025","description":"Cisco Talos. (2025, February 20). Weathering the storm: In the midst of a Typhoon. Retrieved February 24, 2025.","url":"https://blog.talosintelligence.com/salt-typhoon-analysis/"}]},{"id":"G1055","name":"VOID MANTICORE","url":"https://attack.mitre.org/groups/G1055","kind":"intrusion-set","description":"[VOID MANTICORE](https://attack.mitre.org/groups/G1055) has used tunneling tools to facilitate destructive attacks on compromised devices.(Citation: Check Point VOID MANTICORE Handala Hack March 2026)","relationship_id":"relationship--dc6d99c1-b20e-448b-a6ed-7d5412bf24d3","references":[{"source_name":"Check Point VOID MANTICORE Handala Hack March 2026","description":"Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.","url":"https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/"}]}],"mitigations":[{"id":"M1031","name":"Network Intrusion Prevention","url":"https://attack.mitre.org/mitigations/M1031","kind":"course-of-action","description":"Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. ","relationship_id":"relationship--17639fa3-3f77-4481-b24f-9df82fcbf324","references":[]},{"id":"M1037","name":"Filter Network Traffic","url":"https://attack.mitre.org/mitigations/M1037","kind":"course-of-action","description":"Consider filtering network traffic to untrusted or known bad domains and resources. ","relationship_id":"relationship--0927eb00-4a08-4ed1-8678-84d6e1e87b98","references":[]}],"candidates":[{"id":"0c5f9705-c575-42a6-9609-cbbff4b2fc9b","name":"DNS over HTTPS Regular Beaconing","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1572/T1572.yaml","description":"This test simulates an infected host beaconing via DoH queries to a command and control server at regular intervals over time.\nThis behaviour is typical of implants either in an idle state waiting for instructions or configured to use a low query volume over time to evade threshold based detection.\nA custom domain and sub-domain will need to be passed as input parameters for this test to work. Upon execution, DNS information about the domain will be displayed for each callout in a JSON format.\n","inputs":{"doh_server":{"description":"Default DoH resolver","type":"string","default":"https://8.8.8.8/resolve"},"runtime":{"description":"Time in minutes to run the simulation","type":"integer","default":30},"domain":{"description":"Default domain to simulate against","type":"string","default":"127.0.0.1.xip.io"},"subdomain":{"description":"Subdomain prepended to the domain name","type":"string","default":"atomicredteam"},"query_type":{"description":"DNS query type","type":"string","default":"TXT"},"c2_interval":{"description":"Seconds between C2 requests to the command and control server","type":"integer","default":30},"c2_jitter":{"description":"Percentage of jitter to add to the C2 interval to create variance in the times between C2 requests","type":"integer","default":20}},"dependencies":[],"source_definition_sha256":"3a2426864108f87d95d0c2ab1e29a1f421a0b3d435747d96d5b17b91db5462df"},{"id":"228c336a-2f79-4043-8aef-bfa453a611d5","name":"Cloudflare tunnels (Linux/macOS)","platforms":["linux","macos"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1572/T1572.yaml","description":"Cloudflared can be used for exposing local development environment/services/files over the internet.\nThis atomic will generate a dev tunnel binding it to the local service running on the provided port.\nReference:\n- [Cloudflared Docs](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/)\n- [LOT Tunnels](https://lottunnels.github.io/lottunnels/Binaries/cloudflared/)\n","inputs":{"cloudflared_artifact_base_url":{"description":"Base URL to download cloudflared","type":"string","default":"https://github.com/cloudflare/cloudflared/releases/latest/download"},"binary_path":{"description":"path to download cloudflared","type":"string","default":"PathToAtomicsFolder/../ExternalPayloads/cloudflared"},"url_to_tunnel":{"description":"IP and port to expose","type":"string","default":"localhost:8080"},"additional_args":{"description":"Additional arguments to pass to cloudflared","type":"string","default":""}},"dependencies":[{"description":"Download cloudflared\n"}],"source_definition_sha256":"ec447bf70e6c9685188896970b974e230dfe8ced200497822641b3bef5acc738"},{"id":"3afc90c4-90b3-44af-8d14-52852abe7258","name":"Install and Run gost Tunnel Proxy","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1572/T1572.yaml","description":"Downloads and runs gost (Go Simple Tunnel), a multi-protocol proxy and tunnel\ntool used by adversaries to establish SOCKS5 proxies, protocol relays, and\nencrypted tunnels on compromised hosts to facilitate C2 communication and\nlateral movement while evading network controls.\n","inputs":{"remote_url":{"description":"URL to download the gost release archive","type":"url","default":"https://github.com/go-gost/gost/releases/download/v3.2.6/gost_3.2.6_linux_amd64.tar.gz"},"gost_path":{"description":"Path to store the gost binary","type":"path","default":"PathToAtomicsFolder/../ExternalPayloads/gost"},"listen_port":{"description":"Local port for the SOCKS5 proxy listener","type":"integer","default":1080}},"dependencies":[{"description":"gost binary must exist at #{gost_path}/gost\n"}],"source_definition_sha256":"259af7d1db8d20b1830b66f4f465f90445dbb7eacc6a6504670a6a1db7d401d2"},{"id":"4cdc9fc7-53fb-4894-9f0c-64836943ea60","name":"run ngrok","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1572/T1572.yaml","description":"Download and run ngrok. Create tunnel to chosen port.\n","inputs":{"api_token":{"description":"ngrok API","type":"string","default":"N/A"},"port_num":{"description":"port number for tunnel","type":"integer","default":3389},"download":{"description":"link to download ngrok","type":"string","default":"https://bin.equinox.io/c/bNyj1mQVY4c/ngrok-v3-stable-windows-amd64.zip"}},"dependencies":[{"description":"Download ngrok\n"}],"source_definition_sha256":"60def3440fa7451cc7d4d52464e284ec4e847c9604763c29ea72251b17d876cd"},{"id":"748a73d5-cea4-4f34-84d8-839da5baa99c","name":"DNS over HTTPS Long Domain Query","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1572/T1572.yaml","description":"This test simulates an infected host returning data to a command and control server using long domain names.\nThe simulation involves sending DoH queries that gradually increase in length until reaching the maximum length. The intent is to test the effectiveness of detection of DoH queries for long domain names over a set threshold.\n Upon execution, DNS information about the domain will be displayed for each callout in a JSON format.\n","inputs":{"doh_server":{"description":"Default DoH resolver","type":"string","default":"https://8.8.8.8/resolve"},"query_type":{"description":"DNS query type","type":"string","default":"TXT"},"subdomain":{"description":"Subdomain prepended to the domain name (should be 63 characters to test maximum length)","type":"string","default":"atomicredteamatomicredteamatomicredteamatomicredteamatomicredte"},"domain":{"description":"Default domain to simulate against","type":"string","default":"127.0.0.1.xip.io"}},"dependencies":[],"source_definition_sha256":"f8b553f8067d9787659b274f6f79ff9ba453744d82609586692d865b5919884a"},{"id":"9f94a112-1ce2-464d-a63b-83c1f465f801","name":"Microsoft Dev tunnels (Linux/macOS)","platforms":["linux","macos"],"method":"automated","executor":"bash","elevation_required":false,"dependency_count":2,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1572/T1572.yaml","description":"Dev Tunnels enables insiders as well as threat actors to expose local ports over the internet via Microsoft dev tunnels.\n\nThis atomic will generate a dev tunnel binding it to the local service running on the provided port. Can be used to expose local services, web applications and local files etc.\nReference:\n- [Microsoft Docs](https://learn.microsoft.com/en-us/tunnels/dev-tunnels-overview)\n- [LOT Tunnels](https://lottunnels.github.io/lottunnels/Binaries/devtunnels/)\n","inputs":{"port":{"description":"port number for tunnel","type":"integer","default":8080},"download_url":{"description":"link to download devtunnel","type":"string","default":"https://aka.ms/TunnelsCliDownload/linux-x64"},"binary_path":{"description":"path to download devtunnel","type":"string","default":"PathToAtomicsFolder/../ExternalPayloads/devtunnel"}},"dependencies":[{"description":"Download devtunnel\n"},{"description":"Login to Microsoft Dev tunnels\n"}],"source_definition_sha256":"1357565fa769d0a748cf266fac64981344662533c7acb1e419389d838cc558c1"},{"id":"ae9ef4b0-d8c1-49d4-8758-06206f19af0a","name":"DNS over HTTPS Large Query Volume","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1572/T1572.yaml","description":"This test simulates an infected host sending a large volume of DoH queries to a command and control server.\nThe intent of this test is to trigger threshold based detection on the number of DoH queries either from a single source system or to a single targe domain.\nA custom domain and sub-domain will need to be passed as input parameters for this test to work. Upon execution, DNS information about the domain will be displayed for each callout in a JSON format.\n","inputs":{"doh_server":{"description":"Default DoH resolver","type":"string","default":"https://8.8.8.8/resolve"},"query_type":{"description":"DNS query type","type":"string","default":"TXT"},"subdomain":{"description":"Subdomain prepended to the domain name","type":"string","default":"atomicredteam"},"query_volume":{"description":"Number of DNS queries to send","type":"integer","default":1000},"domain":{"description":"Default domain to simulate against","type":"string","default":"127.0.0.1.xip.io"}},"dependencies":[],"source_definition_sha256":"3a03c018e7200405833b7c24fd80138a13223e82450061dba6563fe231bc04a9"},{"id":"b877943f-0377-44f4-8477-f79db7f07c4d","name":"VSCode tunnels (Linux/macOS)","platforms":["linux","macos"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":2,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1572/T1572.yaml","description":"Visual Studio Code Remote Tunnels can be used for exposing local development environment/services/files over the internet.\nThis atomic will generate a dev tunnel binding it to the local service running on the provided port.\nReference:\n- [Microsoft Docs](https://code.visualstudio.com/docs/remote/tunnels)\n- [LOT Tunnels](https://lottunnels.github.io/lottunnels/Binaries/vscode-server/)\n","inputs":{"artifact_base_url":{"description":"Base URL to download code-cli","type":"string","default":"https://code.visualstudio.com/sha/download"},"artifact_build":{"description":"build to download - Allowed values (stable/insiders)","type":"string","default":"stable"},"payload_path":{"description":"path to download code-cli","type":"string","default":"PathToAtomicsFolder/../ExternalPayloads"},"additional_args":{"description":"additional arguments to pass to code tunnel","type":"string","default":""}},"dependencies":[{"description":"Install code-cli\n"},{"description":"Login to VSCode Dev tunnels\n"}],"source_definition_sha256":"319d1fa42de6830758e048ab324fc27107d1fdd077bd5cfde0cd8e25698fab01"},{"id":"f54179ee-c782-4fe3-b836-213d3bda66a2","name":"Install and Run frpc Reverse Proxy Client","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1572/T1572.yaml","description":"Downloads and runs frpc (fast reverse proxy client), the victim-side component\nof the frp framework. Adversaries deploy frpc on compromised hosts to establish\noutbound tunnel connections to an attacker-controlled frps server, bypassing\ninbound firewall rules and exposing internal services externally.\n","inputs":{"remote_url":{"description":"URL to download the frp release archive","type":"url","default":"https://github.com/fatedier/frp/releases/download/v0.71.0/frp_0.71.0_linux_amd64.tar.gz"},"frp_path":{"description":"Path to extract the frp archive","type":"path","default":"PathToAtomicsFolder/../ExternalPayloads/frp"},"server_addr":{"description":"Address of the frps server to connect to","type":"string","default":"127.0.0.1"},"server_port":{"description":"Port of the frps server to connect to","type":"integer","default":7000}},"dependencies":[{"description":"frpc binary must exist at #{frp_path}/frpc\n"}],"source_definition_sha256":"0c4cc2c8762861554bd2131965f1aaa469d69cbf5e85d6d74272205d8f8a54b6"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1572":"/ttp-simulation/techniques/enterprise/T1572/","T1568":"/ttp-simulation/techniques/enterprise/T1568/","T1090":"/ttp-simulation/techniques/enterprise/T1090/","T1001.003":"/ttp-simulation/techniques/enterprise/T1001.003/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1572","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}