Techniques › T1572 › AN1483
AN1483 Analytic 1483
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Processes such as plink.exe, ssh.exe, or netsh.exe establishing outbound network connections where traffic patterns show encapsulated protocols (e.g., RDP over SSH). Defender observations include anomalous process-to-network relationships, large asymmetric data flows, and port usage mismatches.</p>
- Detects
- T1572 Protocol Tunneling
- Part of
- DET0538 Detection Strategy for Protocol Tunneling accross OS platforms.
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=3, 22 | DC0082 Network Connection Creation |
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
AllowedTools | Whitelist legitimate tunneling tools (e.g., used by admins). |
DataAsymmetryThreshold | Ratio of sent vs received bytes that indicates tunneling activity. |
TimeWindow | Correlate process creation with network connection within N seconds. |