1200kmSECURITY RESEARCH
Loading interactive filters…

1200KM / simulation

T1572 Protocol Tunneling — Attack Simulation

Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of…

Complete technique description

Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet.

There are various means to encapsulate a protocol within another protocol. For example, adversaries may perform SSH tunneling (also known as SSH port forwarding), which involves forwarding arbitrary data over an encrypted SSH tunnel.[SSH Tunneling][Sygnia Abyss Locker 2025]

Protocol Tunneling may also be abused by adversaries during Dynamic Resolution. Known as DNS over HTTPS (DoH), queries to resolve C2 infrastructure may be encapsulated within encrypted HTTPS packets.[BleepingComp Godlua JUL19]

Adversaries may also leverage Protocol Tunneling in conjunction with Proxy and/or Protocol or Service Impersonation to further conceal C2 communications and infrastructure.

Official technique definition · Open in the interactive matrix

Detection telemetry and configuration

These contracts are selected through exact technique-to-data-component relationships or explicitly labelled planning overrides. Configure a collector at the relevant observation point; a telemetry name alone is not coverage.

Application Log Content · source-mapped

DC0038 collection page — Select the application event family required by the detection and document its native schema before normalization.

Providers and collection configuration

  • Enable the application audit category or instrument the owned lab application at the authorization/action boundary.
  • Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.
  • Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart.

Required normalized fields: service, action, actor, record_count, result.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0038",
  "collector": "illustrative-lab-collector",
  "observation": {
    "service": "lab-portal",
    "action": "export_requested",
    "actor": "lab-reader",
    "record_count": 3,
    "result": "authorized"
  }
}

Visibility limits: Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.

Network Connection Creation · source-mapped

DC0082 collection page — Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.

Providers and collection configuration

  • Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
  • Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
  • Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.
  • On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
  • Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
  • For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_guid, destination_ip, destination_port, protocol, initiated.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0082",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_guid": "lab-process-001",
    "destination_ip": "198.51.100.20",
    "destination_port": 443,
    "protocol": "tcp",
    "initiated": true
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

Network Traffic Content · source-mapped

DC0085 collection page — Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.

Providers and collection configuration

  • Zeek: Connection and protocol metadata from traffic visible to the sensor.
  • Suricata EVE: Configured flow, alert, DNS, HTTP, TLS and protocol records.
  • Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.
  • Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.
  • Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection.

Required normalized fields: flow_id, protocol, method, path, payload_excerpt.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0085",
  "collector": "illustrative-lab-collector",
  "observation": {
    "flow_id": "lab-flow-1",
    "protocol": "http",
    "method": "GET",
    "path": "/lab-check",
    "payload_excerpt": "LAB_TELEMETRY_CHECK"
  }
}

Visibility limits: Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.

Network Traffic Flow · source-mapped

DC0078 collection page — Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.

Providers and collection configuration

  • Zeek: Connection and protocol metadata from traffic visible to the sensor.
  • Suricata EVE: Configured flow, alert, DNS, HTTP, TLS and protocol records.
  • AWS VPC Flow Logs: IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.
  • Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.
  • Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.
  • Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection.

Required normalized fields: source_ip, destination_ip, destination_port, protocol, bytes_sent, bytes_received.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0078",
  "collector": "illustrative-lab-collector",
  "observation": {
    "source_ip": "192.0.2.10",
    "destination_ip": "198.51.100.20",
    "destination_port": 443,
    "protocol": "tcp",
    "bytes_sent": 128,
    "bytes_received": 512
  }
}

Visibility limits: Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.

Process Creation · source-mapped

DC0032 collection page — Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.

Providers and collection configuration

  • Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
  • Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
  • Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.
  • On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
  • Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
  • For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_guid, image, parent_image, command_line, user.

<EventFiltering>
  <ProcessCreate onmatch="include">
    <Image condition="is">C:\Windows\System32\whoami.exe</Image>
  </ProcessCreate>
</EventFiltering>

This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0032",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_guid": "lab-process-001",
    "image": "C:\\Windows\\System32\\whoami.exe",
    "parent_image": "C:\\Windows\\System32\\cmd.exe",
    "command_line": "whoami",
    "user": "LAB\\analyst"
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

Detection rules and analytic guidance

Open the dedicated detection workspace · Existing query engineering

DET0538 Detection Strategy for Protocol Tunneling accross OS platforms.

MITRE detection strategy

AN1483 Analytic 1483

Processes such as plink.exe, ssh.exe, or netsh.exe establishing outbound network connections where traffic patterns show encapsulated protocols (e.g., RDP over SSH). Defender observations include anomalous process-to-network relationships, large asymmetric data flows, and port usage mismatches.

Platforms: Windows.

AN1484 Analytic 1484

sshd, socat, or custom binaries initiating port forwarding or encapsulating traffic (e.g., RDP, SMB) through SSH or HTTP. Defender sees abnormal connect/bind syscalls, encrypted traffic on ports typically used for non-encrypted services, and outlier traffic volume patterns.

Platforms: Linux.

AN1485 Analytic 1485

launchd or user-invoked processes (ssh, socat) encapsulating traffic via SSH tunnels, VPN-style tooling, or DNS-over-HTTPS clients. Defender sees outbound TLS traffic with embedded DNS or RDP payloads.

Platforms: macOS.

  • Process Creation — macos:unifiedlog; channel process execution of ssh with -L/-R forwarding flags.
  • Network Traffic Content — macos:unifiedlog; channel encrypted outbound traffic carrying unexpected application data.

AN1486 Analytic 1486

VMware daemons or user processes encapsulating traffic (e.g., guest VMs tunneling via hostd). Defender sees network services inside ESXi creating flows inconsistent with management plane traffic, such as SSH forwarding or DNS-over-HTTPS from management interfaces.

Platforms: ESXi.

  • Network Traffic Flow — esxi:vpxd; channel ESXi processes relaying traffic via SSH or unexpected ports.
  • Network Traffic Content — esxcli:network; channel listening sockets bound with non-standard encapsulated protocols.
Source rule directory and observation requirements

23 exact-tagged source rules. A source tag is a discovery aid, not a relevance verdict. Check the observation point and actual condition of each rule.

Before treating a rule as coverage

  1. Read the actual condition and logsource; identify attacker-side, victim-side or third-party visibility.
  2. Map native sensor fields, parse times and identities, then compile for the selected backend.
  3. Replay a behavior-positive case, a normal control, an authorized look-alike and a missing-telemetry case.
  4. Record matches and misses with rule version and source events. No match is inconclusive when required telemetry is absent.

Anomaly-based detection

No exact technique-specific Atlas model is present for T1572 in the selected source snapshot. The following is a design worksheet, not a newly validated model.

Anomaly engineering worksheet

Start from the exact analytic above. The collection-specific lenses below are analyst recommendations; they do not assert that an arbitrary statistical deviation detects this technique.

  • Application and service audit: Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines.
  • Endpoint activity: Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity.
  • Network and protocol telemetry: Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects.
  1. Define an entity/peer group and feature; exclude the evaluation period from baseline training.
  2. Use representative normal and maintenance activity. Do not invent a production threshold from a synthetic example.
  3. Evaluate held-out behavior-positive and benign cases; measure false positives, misses and telemetry loss separately.
  4. Keep abnormality separate from maliciousness. Correlate with the behavior-specific source evidence.

Anomaly Detection Atlas · Baseline, validation and blind spots

Attack tools and documented software

Software observed in source procedures

These are exact ATT&CK software-use relationships, including malware. They provide behavior context, not recommendations to download or execute malware. No safety or detector claim is inherited.

22 source-documented software associations

Simulation design and documented procedures

Atomic evidence: 9 compatible documented candidates. Live lab status: not run for these imported procedures.

Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.

DNS over HTTPS Regular Beaconing

This test simulates an infected host beaconing via DoH queries to a command and control server at regular intervals over time.
This behaviour is typical of implants either in an idle state waiting for instructions or configured to use a low query volume over time to evade threshold based detection.
A custom domain and sub-domain will need to be passed as input parameters for this test to work. Upon execution, DNS information about the domain will be displayed for each callout in a JSON format.

Pinned Atomic procedure · 0c5f9705-c575-42a6-9609-cbbff4b2fc9b · windows · powershell.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

  • doh_server: Default DoH resolver (type string; source default https://8.8.8.8/resolve)
  • runtime: Time in minutes to run the simulation (type integer; source default 30)
  • domain: Default domain to simulate against (type string; source default 127.0.0.1.xip.io)
  • subdomain: Subdomain prepended to the domain name (type string; source default atomicredteam)
  • query_type: DNS query type (type string; source default TXT)
  • c2_interval: Seconds between C2 requests to the command and control server (type integer; source default 30)
  • c2_jitter: Percentage of jitter to add to the C2 interval to create variance in the times between C2 requests (type integer; source default 20)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Cloudflare tunnels (Linux/macOS)

Cloudflared can be used for exposing local development environment/services/files over the internet. This atomic will generate a dev tunnel binding it to the local service running on the provided port. Reference: - Cloudflared Docs - LOT Tunnels

Pinned Atomic procedure · 228c336a-2f79-4043-8aef-bfa453a611d5 · linux, macos · sh.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

Source-defined inputs

  • cloudflared_artifact_base_url: Base URL to download cloudflared (type string; source default https://github.com/cloudflare/cloudflared/releases/latest/download)
  • binary_path: path to download cloudflared (type string; source default PathToAtomicsFolder/../ExternalPayloads/cloudflared)
  • url_to_tunnel: IP and port to expose (type string; source default localhost:8080)
  • additional_args: Additional arguments to pass to cloudflared (type string; source default )

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

  • Download cloudflared
Install and Run gost Tunnel Proxy

Downloads and runs gost (Go Simple Tunnel), a multi-protocol proxy and tunnel
tool used by adversaries to establish SOCKS5 proxies, protocol relays, and
encrypted tunnels on compromised hosts to facilitate C2 communication and
lateral movement while evading network controls.

Pinned Atomic procedure · 3afc90c4-90b3-44af-8d14-52852abe7258 · linux · sh.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

Source-defined inputs

  • remote_url: URL to download the gost release archive (type url; source default https://github.com/go-gost/gost/releases/download/v3.2.6/gost_3.2.6_linux_amd64.tar.gz)
  • gost_path: Path to store the gost binary (type path; source default PathToAtomicsFolder/../ExternalPayloads/gost)
  • listen_port: Local port for the SOCKS5 proxy listener (type integer; source default 1080)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

  • gost binary must exist at #{gost_path}/gost
run ngrok

Download and run ngrok. Create tunnel to chosen port.

Pinned Atomic procedure · 4cdc9fc7-53fb-4894-9f0c-64836943ea60 · windows · powershell.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

Source-defined inputs

  • api_token: ngrok API (type string; source default N/A)
  • port_num: port number for tunnel (type integer; source default 3389)
  • download: link to download ngrok (type string; source default https://bin.equinox.io/c/bNyj1mQVY4c/ngrok-v3-stable-windows-amd64.zip)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

  • Download ngrok
DNS over HTTPS Long Domain Query

This test simulates an infected host returning data to a command and control server using long domain names.
The simulation involves sending DoH queries that gradually increase in length until reaching the maximum length. The intent is to test the effectiveness of detection of DoH queries for long domain names over a set threshold.
Upon execution, DNS information about the domain will be displayed for each callout in a JSON format.

Pinned Atomic procedure · 748a73d5-cea4-4f34-84d8-839da5baa99c · windows · powershell.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

  • doh_server: Default DoH resolver (type string; source default https://8.8.8.8/resolve)
  • query_type: DNS query type (type string; source default TXT)
  • subdomain: Subdomain prepended to the domain name (should be 63 characters to test maximum length) (type string; source default atomicredteamatomicredteamatomicredteamatomicredteamatomicredte)
  • domain: Default domain to simulate against (type string; source default 127.0.0.1.xip.io)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Microsoft Dev tunnels (Linux/macOS)

Dev Tunnels enables insiders as well as threat actors to expose local ports over the internet via Microsoft dev tunnels.

This atomic will generate a dev tunnel binding it to the local service running on the provided port. Can be used to expose local services, web applications and local files etc. Reference: - Microsoft Docs - LOT Tunnels

Pinned Atomic procedure · 9f94a112-1ce2-464d-a63b-83c1f465f801 · linux, macos · bash.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

Source-defined inputs

  • port: port number for tunnel (type integer; source default 8080)
  • download_url: link to download devtunnel (type string; source default https://aka.ms/TunnelsCliDownload/linux-x64)
  • binary_path: path to download devtunnel (type string; source default PathToAtomicsFolder/../ExternalPayloads/devtunnel)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

2 prerequisite definitions:

  • Download devtunnel
  • Login to Microsoft Dev tunnels
DNS over HTTPS Large Query Volume

This test simulates an infected host sending a large volume of DoH queries to a command and control server.
The intent of this test is to trigger threshold based detection on the number of DoH queries either from a single source system or to a single targe domain.
A custom domain and sub-domain will need to be passed as input parameters for this test to work. Upon execution, DNS information about the domain will be displayed for each callout in a JSON format.

Pinned Atomic procedure · ae9ef4b0-d8c1-49d4-8758-06206f19af0a · windows · powershell.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

  • doh_server: Default DoH resolver (type string; source default https://8.8.8.8/resolve)
  • query_type: DNS query type (type string; source default TXT)
  • subdomain: Subdomain prepended to the domain name (type string; source default atomicredteam)
  • query_volume: Number of DNS queries to send (type integer; source default 1000)
  • domain: Default domain to simulate against (type string; source default 127.0.0.1.xip.io)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

VSCode tunnels (Linux/macOS)

Visual Studio Code Remote Tunnels can be used for exposing local development environment/services/files over the internet. This atomic will generate a dev tunnel binding it to the local service running on the provided port. Reference: - Microsoft Docs - LOT Tunnels

Pinned Atomic procedure · b877943f-0377-44f4-8477-f79db7f07c4d · linux, macos · sh.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

Source-defined inputs

  • artifact_base_url: Base URL to download code-cli (type string; source default https://code.visualstudio.com/sha/download)
  • artifact_build: build to download - Allowed values (stable/insiders) (type string; source default stable)
  • payload_path: path to download code-cli (type string; source default PathToAtomicsFolder/../ExternalPayloads)
  • additional_args: additional arguments to pass to code tunnel (type string; source default )

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

2 prerequisite definitions:

  • Install code-cli
  • Login to VSCode Dev tunnels
Install and Run frpc Reverse Proxy Client

Downloads and runs frpc (fast reverse proxy client), the victim-side component
of the frp framework. Adversaries deploy frpc on compromised hosts to establish
outbound tunnel connections to an attacker-controlled frps server, bypassing
inbound firewall rules and exposing internal services externally.

Pinned Atomic procedure · f54179ee-c782-4fe3-b836-213d3bda66a2 · linux · sh.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

Source-defined inputs

  • remote_url: URL to download the frp release archive (type url; source default https://github.com/fatedier/frp/releases/download/v0.71.0/frp_0.71.0_linux_amd64.tar.gz)
  • frp_path: Path to extract the frp archive (type path; source default PathToAtomicsFolder/../ExternalPayloads/frp)
  • server_addr: Address of the frps server to connect to (type string; source default 127.0.0.1)
  • server_port: Port of the frps server to connect to (type integer; source default 7000)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

  • frpc binary must exist at #{frp_path}/frpc

Technique-specific experiment contract

  1. Choose one procedure implementing T1572 Protocol Tunneling; identify the observable behavior in the source definition, not just its tactic.
  2. Record exact target, tool/version, inputs, privileges, network limits and approval. Never run an imported default target automatically.
  3. Enable the collection sources above and verify a benign baseline reaches the detector.
  4. Run only the approved isolated scenario; capture native events and an independent behavior observable.
  5. Evaluate the exact rule/model, restore the lab, and preserve configuration, event hashes, alerts, controls and misses.

Synthetic logs and offline contract check

Download synthetic collection fixture (JSON) · Download the complete engineering workbook

This fixture exercises the listed collection fields. It does not reproduce Protocol Tunneling, label its example events as malicious, or measure detection effectiveness. Use the exact analytic and selected procedure to build an independently labelled behavior-positive dataset.

Not run in this browser. No network scan or attack command is executed by this control.

Validation status and remaining work

Source identity
Joined by exact technique/object IDs against hash-pinned sources.
Collection fixture
Available for offline schema exercises; not attack emulation.
Native telemetry / backend / real attack
Not validated for these imported procedures. Source fidelity and page tests cannot establish sensor or detector effectiveness.

All-page audit and evidence inventory · This page’s machine-readable workbook

Sources and evidence boundaries

Pinned MITRE STIX source · SHA-256 81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352. Definition and procedure context are reproduced from this snapshot, not independently re-investigated incidents.

Source-linked mitigations
  • M1031 Network Intrusion Prevention

    Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.

  • M1037 Filter Network Traffic

    Consider filtering network traffic to untrusted or known bad domains and resources.

Connected ecosystem references

Linked tags

enterprisecloud-hosted-endpointonpremvirtualizationESXiLinuxmacOSWindowscommand-and-controlisolated_authorized_labprocedure_review_requiredtelemetry_configuration_requiredsome_candidates_require_elevation
Atomic candidate documentedtechniquesource_mapped

Source procedure platform / method / executor tags:

windowsautomatedpowershelllinuxmacosshbash

Detection and collection

T1572 detection workspace

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.