Techniques › T1572 › AN1484
AN1484 Analytic 1484
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>sshd, socat, or custom binaries initiating port forwarding or encapsulating traffic (e.g., RDP, SMB) through SSH or HTTP. Defender sees abnormal connect/bind syscalls, encrypted traffic on ports typically used for non-encrypted services, and outlier traffic volume patterns.</p>
- Detects
- T1572 Protocol Tunneling
- Part of
- DET0538 Detection Strategy for Protocol Tunneling accross OS platforms.
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | socket/connect calls showing SSH processes forwarding arbitrary ports | DC0082 Network Connection Creation |
| linux:syslog | sshd sessions with unusual port forwarding parameters | DC0038 Application Log Content |
| linux:osquery | socat, ssh, or nc processes opening unexpected ports | DC0032 Process Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
ForwardingFlags | Specific sshd config flags indicating port forwarding. |
ProtocolBaseline | Define expected application protocols by port to catch tunneling mismatches. |