{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1665","id":"T1665","name":"Hide Infrastructure","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1665","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"3682a6a936a7b72bf9670f33ec04c8a3efecdc5bd2b304186889409704f51e85","description":"Adversaries may manipulate network traffic in order to hide and evade detection of their C2 infrastructure. This can be accomplished by identifying and filtering traffic from defensive tools,(Citation: TA571) masking malicious domains to obfuscate the true destination from both automated scanning tools and security researchers,(Citation: Schema-abuse)(Citation: Facad1ng)(Citation: Browser-updates) and otherwise hiding malicious artifacts to delay discovery and prolong the effectiveness of adversary infrastructure that could otherwise be identified, blocked, or taken down entirely.\n\nC2 networks may include the use of [Proxy](https://attack.mitre.org/techniques/T1090) or VPNs to disguise IP addresses, which can allow adversaries to blend in with normal network traffic and bypass conditional access policies or anti-abuse protections. For example, an adversary may use a virtual private cloud to spoof their IP address to closer align with a victim's IP address ranges. This may also bypass security measures relying on geolocation of the source IP address.(Citation: sysdig)(Citation: Orange Residential Proxies)\n\nAdversaries may also attempt to filter network traffic in order to evade defensive tools in numerous ways, including blocking/redirecting common incident responder or security appliance user agents.(Citation: mod_rewrite)(Citation: SocGholish-update) Filtering traffic based on IP and geo-fencing may also avoid automated sandboxing or researcher activity (i.e., [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497)).(Citation: TA571)(Citation: mod_rewrite)\n\nHiding C2 infrastructure may also be supported by [Resource Development](https://attack.mitre.org/tactics/TA0042) activities such as [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) and [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584). For example, using widely trusted hosting services or domains such as prominent URL shortening providers or marketing services for C2 networks may enable adversaries to present benign content that later redirects victims to malicious web pages or infrastructure once specific conditions are met.(Citation: StarBlizzard)(Citation: QR-cofense)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1665","external_id":"T1665"},{"source_name":"SocGholish-update","description":"Andrew Northern. (2022, November 22). SocGholish, a very real threat from a very fake update. Retrieved February 13, 2024.","url":"https://www.proofpoint.com/us/blog/threat-insight/part-1-socgholish-very-real-threat-very-fake-update"},{"source_name":"TA571","description":"Axel F, Selena Larson. (2023, October 30).  TA571 Delivers IcedID Forked Loader. Retrieved February 13, 2024.","url":"https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta571-delivers-icedid-forked-loader"},{"source_name":"mod_rewrite","description":"Bluescreenofjeff.com. (2015, April 12). Combatting Incident Responders with Apache mod_rewrite. Retrieved February 13, 2024.","url":"https://bluescreenofjeff.com/2016-04-12-combatting-incident-responders-with-apache-mod_rewrite/"},{"source_name":"Browser-updates","description":"Dusty Miller. (2023, October 17). Are You Sure Your Browser is Up to Date? The Current Landscape of Fake Browser Updates . Retrieved February 13, 2024.","url":"https://www.proofpoint.com/us/blog/threat-insight/are-you-sure-your-browser-date-current-landscape-fake-browser-updates"},{"source_name":"StarBlizzard","description":"Microsoft Threat Intelligence. (2023, December 7). Star Blizzard increases sophistication and evasion in ongoing attacks. Retrieved February 13, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2023/12/07/star-blizzard-increases-sophistication-and-evasion-in-ongoing-attacks/"},{"source_name":"QR-cofense","description":"Nathaniel Raymond. (2023, August 16). Major Energy Company Targeted in Large QR Code Phishing Campaign. Retrieved February 13, 2024.","url":"https://cofense.com/blog/major-energy-company-targeted-in-large-qr-code-campaign/"},{"source_name":"Schema-abuse","description":"Nick Simonian. (2023, May 22). Don't @ Me: URL Obfuscation Through Schema Abuse. Retrieved February 13, 2024.","url":"https://www.mandiant.com/resources/blog/url-obfuscation-schema-abuse"},{"source_name":"Orange Residential Proxies","description":"Orange Cyberdefense. (2024, March 14). Unveiling the depths of residential proxies providers. Retrieved April 11, 2024.","url":"https://www.orangecyberdefense.com/global/blog/research/residential-proxies"},{"source_name":"Facad1ng","description":"Spyboy. (2023). Facad1ng. Retrieved February 13, 2024.","url":"https://github.com/spyboy-productions/Facad1ng"},{"source_name":"sysdig","description":"Sysdig. (2023). Sysdig Global Cloud Threat Report. Retrieved March 1, 2024.","url":"https://sysdig.com/content/c/pf-2023-global-cloud-threat-report?x=u_WFRi&xs=524303#page=1"}],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0101","name":"Domain Registration","page":"telemetry/DC0101/","kind":"attack_component","category":"External context and intelligence","description":"Domain registration records and changes used as infrastructure context.","collection_focus":"Query an approved RDAP service/feed, retaining retrieval time and registration-event dates; preserve redaction and missing-field indicators.","providers":[{"name":"Authorized intelligence feeds / STIX repositories","scope":"Provenance-bearing observations and analysis, not direct victim-side logs.","source_id":"stix"},{"name":"RDAP registries/registrars","scope":"Registration context; public fields can be redacted or unavailable.","source_id":"rdap"}],"configuration":["Use an approved feed/API or documented lawful export. Store retrieval time, source URL, original record ID, observation time and confidence separately.","Retain the raw response, licensing constraints and analyst assessment. Deduplicate observations without erasing independent provenance.","Correlate external context with authorized internal observations; do not label ownership, attribution or compromise from a shared indicator alone."],"configuration_example":null,"required_fields":["domain","event","registrant","retrieved_at"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0101","collector":"illustrative-lab-collector","observation":{"domain":"example.test","event":"registration","registrant":"redacted","retrieved_at":"2026-09-27T12:00:00Z"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Coverage, licensing, redaction and reporting delays vary. External context is not proof of access to the target, and cannot substitute for unavailable provider-side audit.","sources":[{"id":"stix","title":"OASIS STIX 2.1 specification","url":"https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html"},{"id":"rdap","title":"ICANN Registration Data Access Protocol","url":"https://www.icann.org/en/contracted-parties/registry-operators/resources/registration-data-access-protocol"}],"association":"attack_component","anomaly_design":"Changes in external infrastructure, registration or published intelligence can supply context. They do not expose private attacker actions or establish a victim-side detector; preserve timestamps and attribution uncertainty."},{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0104","name":"Response Content","page":"telemetry/DC0104/","kind":"attack_component","category":"Network and protocol telemetry","description":"Content returned by a queried service, such as an HTTP response body or banner.","collection_focus":"Capture responses only from authorized lab services or approved datasets; retain request context, response hash and a sanitized bounded excerpt.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["service","response_excerpt","content_type","body_truncated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0104","collector":"illustrative-lab-collector","observation":{"service":"https://lab.example.test/health","response_excerpt":"LAB_OK","content_type":"text/plain","body_truncated":false}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0106","name":"Response Metadata","page":"telemetry/DC0106/","kind":"attack_component","category":"Network and protocol telemetry","description":"Metadata about an Internet-facing resource inferred from authorized scan responses, such as open ports, services and reported versions.","collection_focus":"Preserve target, observation time, scan method and response evidence; distinguish inferred service identity from an authenticated software inventory.","providers":[{"name":"Nmap XML reports","scope":"Structured port/service observations from a separately authorized scan or existing report.","source_id":"nmap"},{"name":"Zeek protocol observations","scope":"Passive corroboration for visible service responses; not equivalent to active scan coverage.","source_id":"zeek"}],"configuration":["Use an existing authorized scan report or an explicitly approved isolated target set. Record tool/version, scan options, time window and scope.","Preserve native XML and normalized host/port/protocol/service fields. Disable XML external-entity resolution in downstream parsers.","Keep inferred service names/versions and their confidence separate from authenticated inventory; retain response evidence when available."],"configuration_example":null,"required_fields":["target","port","transport","service","version","observation_source"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0106","collector":"illustrative-lab-collector","observation":{"target":"192.0.2.20","port":443,"transport":"tcp","service":"https","version":"not_identified","observation_source":"authorized_lab_scan"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A reported open port or banner is not a proven vulnerability. Filtered/no-response states can reflect routing or policy. The website performs no scans.","sources":[{"id":"nmap","title":"Nmap XML output specification","url":"https://nmap.org/book/output-formats-xml-output.html"},{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."}],"detection":{"key":"enterprise/T1665","id":"T1665","name":"Hide Infrastructure","domain":"enterprise","platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1665","technique_page":"techniques/enterprise/T1665/","page":"detections/enterprise/T1665/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0411","name":"Detection Strategy for Hide Infrastructure","url":"https://attack.mitre.org/detectionstrategies/DET0411","stix_id":"x-mitre-detection-strategy--ba2efedb-2670-4072-b56f-8f12daa31923","relationship_id":"relationship--eccb3880-3ab0-4332-b19a-c9b5c180e39c","description":"","analytics":[{"id":"AN1148","name":"Analytic 1148","guidance":"Monitor DNS queries, proxy logs, and user-agent strings for anomalous patterns associated with adversary attempts to hide infrastructure. Defenders may observe DNS resolutions to short-lived domains, abnormal WHOIS registration data, or filtering of known defensive/responder IP addresses.","url":"https://attack.mitre.org/detectionstrategies/DET0411#AN1148","platforms":["Windows"],"tuning":[{"field":"SuspiciousDomains","description":"List of domains registered with privacy-protected or suspicious WHOIS metadata."},{"field":"ResponderIPs","description":"Known incident response or scanning infrastructure IP ranges."}],"log_sources":[{"component_id":"DC0082","component":"Network Connection Creation","name":"WinEventLog:Security","channel":"EventCode=5156, 5157","platforms":["Windows"],"analytic_id":"AN1148","source_url":"https://attack.mitre.org/detectionstrategies/DET0411#AN1148","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"},{"component_id":"DC0101","component":"Domain Registration","name":"dns:query","channel":"Excessive lookups for domains with suspicious WHOIS or short TTL values","platforms":["Windows"],"analytic_id":"AN1148","source_url":"https://attack.mitre.org/detectionstrategies/DET0411#AN1148","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0101/"}]},{"id":"AN1149","name":"Analytic 1149","guidance":"Detect adversaries filtering traffic or modifying server responses to evade scanning. Monitor iptables, nftables, or proxy configurations that deny or redirect requests from known scanning agents or defensive tools.","url":"https://attack.mitre.org/detectionstrategies/DET0411#AN1149","platforms":["Linux"],"tuning":[{"field":"BlockedAgents","description":"User-agent strings or scanning tools to monitor for selective filtering."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve: Execution of commands modifying iptables/nftables to block selective IPs","platforms":["Linux"],"analytic_id":"AN1149","source_url":"https://attack.mitre.org/detectionstrategies/DET0411#AN1149","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0106","component":"Response Metadata","name":"NSM:Flow","channel":"Altered response metadata or blocked content based on user-agent or geolocation","platforms":["Linux"],"analytic_id":"AN1149","source_url":"https://attack.mitre.org/detectionstrategies/DET0411#AN1149","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0106/"}]},{"id":"AN1150","name":"Analytic 1150","guidance":"Monitor unified logs for manipulation of proxy configurations, DNS resolution, or filtering rules. Adversaries may redirect responses or use trusted domains that later resolve to malicious C2 infrastructure.","url":"https://attack.mitre.org/detectionstrategies/DET0411#AN1150","platforms":["macOS"],"tuning":[{"field":"TrustedHostingProviders","description":"Known hosting/CDN providers often abused to hide malicious C2 infrastructure."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"System process modifications altering DNS/proxy settings","platforms":["macOS"],"analytic_id":"AN1150","source_url":"https://attack.mitre.org/detectionstrategies/DET0411#AN1150","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0104","component":"Response Content","name":"NSM:Flow","channel":"Suspicious changes in TLS certificate responses or redirected domains","platforms":["macOS"],"analytic_id":"AN1150","source_url":"https://attack.mitre.org/detectionstrategies/DET0411#AN1150","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0104/"}]},{"id":"AN1151","name":"Analytic 1151","guidance":"Inspect network telemetry for adversary attempts to blend malicious traffic with legitimate flows using VPNs, proxies, or geolocation spoofing. Defensive teams may observe anomalous tunnels, encrypted sessions to suspicious domains, or geo-mismatched IP activity.","url":"https://attack.mitre.org/detectionstrategies/DET0411#AN1151","platforms":["Network Devices"],"tuning":[{"field":"GeoIPRanges","description":"Regions to monitor for unexpected or mismatched geolocation activity."}],"log_sources":[{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Flow","channel":"Encrypted tunnels or proxy traffic to non-standard destinations","platforms":["Network Devices"],"analytic_id":"AN1151","source_url":"https://attack.mitre.org/detectionstrategies/DET0411#AN1151","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]},{"id":"AN1152","name":"Analytic 1152","guidance":"Monitor VM-level DNS and network traffic logs for adversary-controlled domains or selective response behavior (e.g., dropped requests from security scanners).","url":"https://attack.mitre.org/detectionstrategies/DET0411#AN1152","platforms":["ESXi"],"tuning":[{"field":"MonitoredVMs","description":"Targeted virtual machines where adversaries may attempt to hide C2 traffic."}],"log_sources":[{"component_id":"DC0101","component":"Domain Registration","name":"esxi:vmkernel","channel":"DNS lookups resolving to domains with rapid changes in registration metadata","platforms":["ESXi"],"analytic_id":"AN1152","source_url":"https://attack.mitre.org/detectionstrategies/DET0411#AN1152","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0101/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"esxi:vmkernel","channel":"Suspicious traffic filtered or redirected by VM networking stack","platforms":["ESXi"],"analytic_id":"AN1152","source_url":"https://attack.mitre.org/detectionstrategies/DET0411#AN1152","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]}]}],"telemetry_references":[{"id":"DC0101","name":"Domain Registration","tag":"Domain Registration","page":"telemetry/DC0101/","kind":"attack_component"},{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0104","name":"Response Content","tag":"Response Content","page":"telemetry/DC0104/","kind":"attack_component"},{"id":"DC0106","name":"Response Metadata","tag":"Response Metadata","page":"telemetry/DC0106/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S1111","name":"DarkGate","url":"https://attack.mitre.org/software/S1111","kind":"malware","description":"[DarkGate](https://attack.mitre.org/software/S1111) command and control includes hard-coded domains in the malware masquerading as legitimate services such as Akamai CDN or Amazon Web Services.(Citation: Trellix Darkgate 2023)","relationship_id":"relationship--7cde9b70-5de6-4aed-be28-27072987f2e8","references":[{"source_name":"Trellix Darkgate 2023","description":"Ernesto Fernández Provecho, Pham Duy Phuc, Ciana Driscoll & Vinoo Thomas. (2023, November 21). The Continued Evolution of the DarkGate Malware-as-a-Service. Retrieved February 9, 2024.","url":"https://www.trellix.com/blogs/research/the-continued-evolution-of-the-darkgate-malware-as-a-service/"}]},{"id":"S1164","name":"UPSTYLE","url":"https://attack.mitre.org/software/S1164","kind":"malware","description":"[UPSTYLE](https://attack.mitre.org/software/S1164) attempts to retrieve a non-existent webpage from the command and control server resulting in hidden commands sent via resulting error messages.(Citation: Volexity UPSTYLE 2024)","relationship_id":"relationship--f3ab39f8-8b3e-429d-8eea-f264c0668d86","references":[{"source_name":"Volexity UPSTYLE 2024","description":"Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.","url":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/"}]},{"id":"S1206","name":"JumbledPath","url":"https://attack.mitre.org/software/S1206","kind":"malware","description":"[JumbledPath](https://attack.mitre.org/software/S1206) can use a chain of jump hosts to communicate with compromised devices to obscure actor infrastructure.(Citation: Cisco Salt Typhoon FEB 2025)","relationship_id":"relationship--7539909c-0239-4d96-8d9a-cf694fc10ce2","references":[{"source_name":"Cisco Salt Typhoon FEB 2025","description":"Cisco Talos. (2025, February 20). Weathering the storm: In the midst of a Typhoon. Retrieved February 24, 2025.","url":"https://blog.talosintelligence.com/salt-typhoon-analysis/"}]}],"actors":[{"id":"G0016","name":"APT29","url":"https://attack.mitre.org/groups/G0016","kind":"intrusion-set","description":"[APT29](https://attack.mitre.org/groups/G0016) uses compromised residential endpoints, typically within the same ISP IP address range, as proxies to hide the true source of C2 traffic.(Citation: NCSC et al APT29 2024)","relationship_id":"relationship--b6a99c7b-0c5c-4d07-ad28-273648ae081e","references":[{"source_name":"NCSC et al APT29 2024","description":"UK National Cyber Security Center et al. (2024, February). SVR cyber actors adapt tactics for initial cloud access. Retrieved March 1, 2024.","url":"https://www.ic3.gov/Media/News/2024/240226.pdf"}]},{"id":"G0128","name":"ZIRCONIUM","url":"https://attack.mitre.org/groups/G0128","kind":"intrusion-set","description":"[ZIRCONIUM](https://attack.mitre.org/groups/G0128) has utilized an ORB (operational relay box) network – consisting compromised devices such as small office and home office (SOHO) routers, IoT devices, and leased virtual private servers (VPS) – to obfuscate the origin of C2 traffic.(Citation: ORB Mandiant) ","relationship_id":"relationship--170931d2-d803-4cc8-8e05-4218fcbb5f80","references":[{"source_name":"ORB Mandiant","description":"Raggi, Michael. (2024, May 22). IOC Extinction? China-Nexus Cyber Espionage Actors Use ORB Networks to Raise Cost on Defenders. Retrieved July 8, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-orb-networks"}]}],"mitigations":[],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1090":"/ttp-simulation/techniques/enterprise/T1090/","T1497":"/ttp-simulation/techniques/enterprise/T1497/","T1583":"/ttp-simulation/techniques/enterprise/T1583/","T1584":"/ttp-simulation/techniques/enterprise/T1584/","T1665":"/ttp-simulation/techniques/enterprise/T1665/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1665","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0101","collector":"illustrative-lab-collector","observation":{"domain":"example.test","event":"registration","registrant":"redacted","retrieved_at":"2026-09-27T12:00:00Z"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0104","collector":"illustrative-lab-collector","observation":{"service":"https://lab.example.test/health","response_excerpt":"LAB_OK","content_type":"text/plain","body_truncated":false}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0106","collector":"illustrative-lab-collector","observation":{"target":"192.0.2.20","port":443,"transport":"tcp","service":"https","version":"not_identified","observation_source":"authorized_lab_scan"}}]}}