Protocol Tunneling
Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their...
BY SOURCE
PROCEDURES (33)
Auto-extracted: 3 detections for network connection monitoring
Auto-extracted: 3 detections for tunnel
Auto-extracted: 3 detections for persist
Auto-extracted: 3 detections for persist
Auto-extracted: 3 detections for service
Auto-extracted: 2 detections for suspicious
Auto-extracted: 2 detections for process creation monitoring
Auto-extracted: 2 detections for cloud
Auto-extracted: 2 detections for exfiltrat
Auto-extracted: 2 detections for exfiltrat
Auto-extracted: 2 detections for download
Auto-extracted: 2 detections for c2
Auto-extracted: 2 detections for lateral
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for http
Auto-extracted: 1 detections for c2
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for dns
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for encrypt
Auto-extracted: 1 detections for command and control
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for cloud
Auto-extracted: 1 detections for dns
Auto-extracted: 1 detections for cloud
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for dns
Auto-extracted: 1 detections for download
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for command and control
Auto-extracted: 1 detections for encrypt