Techniques › T1090.001 › AN0204
AN0204 Analytic 0204
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Anomalous process (e.g.,
rundll32, svchost, cmd) initiates connections to internal peer hosts not seen in typical communication baselines, used to proxy or forward traffic internally, often using SMB, RPC, or high ports.</p>- Detects
- T1090.001 Internal Proxy
- Part of
- DET0075 Internal Proxy Behavior via Lateral Host-to-Host C2 Relay
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=3, 22 | DC0082 Network Connection Creation |
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| Windows Firewall Log | SMB over high port | DC0078 Network Traffic Flow |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
InternalConnectionPattern | Tune based on known host-to-host communications that are rare (e.g., workstation-to-workstation). |
DestinationPort | Focus on unusual internal traffic on ports like 1080, 8080, 4444, or SMB over non-standard ports. |
TimeWindow | Correlate unusual traffic bursts with new process execution. |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2021-22017 | VMware vCenter Server | Mapped |