EXPLORE
← Back to Explore
T1090

Proxy

Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control c...

ESXiLinuxmacOSNetwork DevicesWindows
44
Detections
3
Sources
17
Threat Actors

BY SOURCE

21sigma18elastic5splunk_escu

PROCEDURES (23)

Process Creation Monitoring6 detections

Auto-extracted: 6 detections for process creation monitoring

General Monitoring4 detections

Auto-extracted: 4 detections for general monitoring

Command And Control3 detections

Auto-extracted: 3 detections for command and control

Exfiltrat3 detections

Auto-extracted: 3 detections for exfiltrat

Persist3 detections

Auto-extracted: 3 detections for persist

C23 detections

Auto-extracted: 3 detections for c2

Cloud2 detections

Auto-extracted: 2 detections for cloud

Bypass2 detections

Auto-extracted: 2 detections for bypass

Tunnel2 detections

Auto-extracted: 2 detections for tunnel

Service2 detections

Auto-extracted: 2 detections for service

Remote2 detections

Auto-extracted: 2 detections for remote

Tunnel1 detections

Auto-extracted: 1 detections for tunnel

Suspicious1 detections

Auto-extracted: 1 detections for suspicious

Bypass1 detections

Auto-extracted: 1 detections for bypass

Registry Monitoring1 detections

Auto-extracted: 1 detections for registry monitoring

Persist1 detections

Auto-extracted: 1 detections for persist

Http1 detections

Auto-extracted: 1 detections for http

Bypass1 detections

Auto-extracted: 1 detections for bypass

Exfiltrat1 detections

Auto-extracted: 1 detections for exfiltrat

Http1 detections

Auto-extracted: 1 detections for http

C21 detections

Auto-extracted: 1 detections for c2

Suspicious1 detections

Auto-extracted: 1 detections for suspicious

Network Connection Monitoring1 detections

Auto-extracted: 1 detections for network connection monitoring

DETECTIONS (44)

Cloudflared Tunnel Connections Cleanup
sigmamedium
Cloudflared Tunnel Execution
sigmamedium
Communication To LocaltoNet Tunneling Service Initiated
sigmahigh
Communication To LocaltoNet Tunneling Service Initiated - Linux
sigmahigh
Communication To Ngrok Tunneling Service - Linux
sigmahigh
Communication To Ngrok Tunneling Service Initiated
sigmahigh
Connection Proxy
sigmalow
Connection to Commonly Abused Web Services
elasticlow
Curl SOCKS Proxy Activity from Unusual Parent
elasticmedium
Curl SOCKS Proxy Detected via Defend for Containers
elasticmedium
FortiGate SOCKS Traffic from an Unusual Process
elasticmedium
HackTool - Htran/NATBypass Execution
sigmahigh
IPv4/IPv6 Forwarding Activity
elasticlow
Kubectl Network Configuration Modification
elasticlow
Linux Ngrok Reverse Proxy Usage
splunk_escu
Linux Proxy Socks Curl
splunk_escu
Malicious IP Address Sign-In Failure Rate
sigmahigh
Malicious IP Address Sign-In Suspicious
sigmahigh
New Port Forwarding Rule Added Via Netsh.EXE
sigmamedium
New PortProxy Registry Entry Added
sigmamedium
Ngrok Reverse Proxy on Network
splunk_escu
Ngrok Usage with Remote Desktop Service
sigmahigh
Okta Non-Standard VPN Usage
splunk_escu
OpenCanary - HTTPPROXY Login Attempt
sigmahigh
Port Forwarding Rule Addition
elasticmedium
Potential Linux Tunneling and/or Port Forwarding
elasticmedium
Potential Linux Tunneling and/or Port Forwarding via Command Line
elasticmedium
Potential Linux Tunneling and/or Port Forwarding via SSH Option
elasticlow
Potential Protocol Tunneling via Chisel Client
elasticmedium
Potential Protocol Tunneling via Cloudflared
elasticmedium
Potential Protocol Tunneling via EarthWorm
elastichigh
Potential Protocol Tunneling via Yuze
elasticmedium
Potential Traffic Tunneling using QEMU
elasticmedium
Potentially Suspicious Usage Of Qemu
sigmamedium
ProxyChains Activity
elasticmedium
PUA - Fast Reverse Proxy (FRP) Execution
sigmahigh
PUA - NPS Tunneling Tool Execution
sigmahigh
PUA- IOX Tunneling Tool Execution
sigmahigh
RDP Port Forwarding Rule Added Via Netsh.EXE
sigmahigh
Sign-In From Malware Infected IP
sigmahigh
Suspicious TCP Tunnel Via PowerShell Script
sigmamedium
Suspicious Utility Launched via ProxyChains
elasticmedium
Tunneling and/or Port Forwarding Detected via Defend for Containers
elasticmedium
Windows Ngrok Reverse Proxy Usage
splunk_escu