T0884 Connection Proxy — Detection Rules

Source-backed rule directory

No reviewed association in this snapshot.

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0759 Detection of Connection Proxy

AN1891 Analytic 1891

Real-time monitoring identifies a Linux process with both a listening socket on an Industrial Control System (ICS) protocol port and an outbound connection to a non-ICS destination, or iptables DNAT/REDIRECT rules added on ICS protocol ports. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.

AN2175 Analytic 2175

Real-time monitoring identifies a host simultaneously maintaining an inbound connection on an Industrial Control System (ICS) protocol port and an outbound connection to a destination outside the ICS network zone, detectable as correlated dual flows with matching timing and approximate byte-count proportionality. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.

AN2237 Analytic 2237

Real-time monitoring identifies a field device or serial gateway receiving Industrial Control System (ICS) protocol traffic relayed through an intermediate host, identifiable by protocol-level timing anomalies or L2 source address changes where the device Internet Protocol (IP) address responds from a Media Access Control (MAC) address different from its enrolled hardware address. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.

AN2275 Analytic 2275

Real-time monitoring identifies a Windows process holding simultaneous connections to both the field device subnet and an external destination, combined with proxy-tool process creation. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.