{"id":"T1090.001","name":"Internal Proxy","url":"https://attack.mitre.org/techniques/T1090/001","tactics":["command-and-control"],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0075","stix_id":"x-mitre-detection-strategy--28630b41-d28f-4414-afc8-23cc9ce8696c","name":"Internal Proxy Behavior via Lateral Host-to-Host C2 Relay","url":"https://attack.mitre.org/detectionstrategies/DET0075","analytics":[{"id":"AN0204","stix_id":"x-mitre-analytic--ca56c2df-0338-4325-964a-0f775d986277","name":"Analytic 0204","description":"Anomalous process (e.g., `rundll32`, `svchost`, `cmd`) initiates connections to internal peer hosts not seen in typical communication baselines, used to proxy or forward traffic internally, often using SMB, RPC, or high ports.","url":"https://attack.mitre.org/detectionstrategies/DET0075#AN0204","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"Windows Firewall Log","channel":"SMB over high port","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"windows-firewall-log"}],"mutable_elements":[{"field":"InternalConnectionPattern","description":"Tune based on known host-to-host communications that are rare (e.g., workstation-to-workstation)."},{"field":"DestinationPort","description":"Focus on unusual internal traffic on ports like 1080, 8080, 4444, or SMB over non-standard ports."},{"field":"TimeWindow","description":"Correlate unusual traffic bursts with new process execution."}],"live":true,"detection_strategies":["DET0075"],"techniques":["T1090.001"]},{"id":"AN0205","stix_id":"x-mitre-analytic--7f269271-6800-4d20-b9f7-6c38cecac6f0","name":"Analytic 0205","description":"`socat`, `ssh`, `iptables`, or `ncat` invoked from user space or cron jobs to create port forwarding, reverse shells, or inter-host tunnels between compromised Linux systems. Behavior is typically paired with socket activity and high entropy traffic.","url":"https://attack.mitre.org/detectionstrategies/DET0075#AN0205","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"NSM:Connections","channel":"Internal connection logging","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"nsm-connections"},{"name":"NSM:Flow","channel":"conn.log","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"UserContext","description":"Alert on unexpected users executing inter-host relay tools (e.g., `www-data`, `backup`)."},{"field":"PortRange","description":"Adjust to watch for commonly misused internal TCP/UDP ports."},{"field":"ProcessPattern","description":"Shell pipelines or wrapped invocations like `bash -c 'socat ...'`"}],"live":true,"detection_strategies":["DET0075"],"techniques":["T1090.001"]},{"id":"AN0206","stix_id":"x-mitre-analytic--c62026a7-3332-489f-bb86-30626c1b3cc8","name":"Analytic 0206","description":"Execution of AppleScript or Automator services launching `ssh -L`, `socat`, or `launchctl` items that dynamically reroute traffic from one Mac endpoint to another. LaunchAgents used to establish permanent internal tunnels.","url":"https://attack.mitre.org/detectionstrategies/DET0075#AN0206","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"None","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"NSM:Flow","channel":"pf firewall logs","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"nsm-flow"},{"name":"macos:osquery","channel":"Process Events and Launch Daemons","data_component":"DC0060","data_component_name":"Service Creation","log_source_slug":"macos-osquery"}],"mutable_elements":[{"field":"LaunchAgentPath","description":"Directory where proxying LaunchDaemons may be dropped, e.g., `/Library/LaunchDaemons/`."},{"field":"PortBindings","description":"Dynamic port forwards often use ephemeral or non-standard service ports."},{"field":"AppleScriptUsage","description":"May trigger on less common scripting interfaces for traffic redirection."}],"live":true,"detection_strategies":["DET0075"],"techniques":["T1090.001"]},{"id":"AN0207","stix_id":"x-mitre-analytic--c1fd84b0-953d-463b-a293-3d6aa81e4589","name":"Analytic 0207","description":"ESXi shell execution of tools/scripts (`nc`, `socat`, `perl`) relaying network traffic to other internal hosts, especially when initiated by unauthorized users or VMs.","url":"https://attack.mitre.org/detectionstrategies/DET0075#AN0207","platforms":["ESXi"],"log_source_references":[{"name":"esxi:shell","channel":"/var/log/shell.log","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"esxi-shell"},{"name":"esxi:vmkernel","channel":"/var/log/vmkernel.log","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"esxi-vmkernel"},{"name":"NSM:Flow","channel":"conn.log","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"CLICommandPattern","description":"Watch for chained shell commands building local-to-local connections."},{"field":"VMInitiator","description":"Correlate to which VM initiated the traffic tunnel; unexpected VM behavior may be suspicious."},{"field":"ConnectionDirectionality","description":"Unusual east-west communication patterns among VMs."}],"live":true,"detection_strategies":["DET0075"],"techniques":["T1090.001"]},{"id":"AN0208","stix_id":"x-mitre-analytic--42ba4dcf-0354-4d70-8c29-d0c3a8c90c23","name":"Analytic 0208","description":"Configuration of internal NAT or proxy rules that redirect traffic between client segments internally (e.g., site-to-site port forwarding). Often used to relay internal beaconing or move traffic laterally through trust zones.","url":"https://attack.mitre.org/detectionstrategies/DET0075#AN0208","platforms":["Network Devices"],"log_source_references":[{"name":"Firewall Audit Logs","channel":"Config Change","data_component":"DC0051","data_component_name":"Firewall Rule Modification","log_source_slug":"firewall-audit-logs"},{"name":"NSM:Flow","channel":"Inter-segment traffic","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"nsm-flow"},{"name":"networkdevice:cli","channel":"Policy Update","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"networkdevice-cli"}],"mutable_elements":[{"field":"ProxyTarget","description":"Internal subnets or endpoint roles allowed for port forwarding."},{"field":"ConfigChangeUser","description":"Detect changes made outside scheduled or authorized windows."},{"field":"FlowThreshold","description":"Volume of data relayed through proxy exceeds historical norms."}],"live":true,"detection_strategies":["DET0075"],"techniques":["T1090.001"]}],"live":true,"version":"1.0","techniques":["T1090.001"]}],"sigma_rules":[{"id":"222129f7-f4dc-4568-b0d2-22440a9639ba","title":"Cloudflared Quick Tunnel Execution","author":"Sajid Nawaz Khan","status":"test","level":"medium","date":"2023-12-20","modified":null,"description":"Detects creation of an ad-hoc Cloudflare Quick Tunnel, which can be used to tunnel local services such as HTTP, RDP, SSH and SMB.\nThe free TryCloudflare Quick Tunnel will generate a random subdomain on trycloudflare[.]com, following a call to api[.]trycloudflare[.]com.\nThe tool has been observed in use by threat groups including Akira ransomware.\n","references":["https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare/","https://github.com/cloudflare/cloudflared","https://www.intrinsec.com/akira_ransomware/","https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.command-and-control","attack.t1090.001"],"path":"rules/windows/process_creation/proc_creation_win_cloudflared_quicktunnel_execution.yml","techniques":["T1090.001"],"cves":[]},{"id":"5bed80b6-b3e8-428e-a3ae-d3c757589e41","title":"RDP over Reverse SSH Tunnel WFP","author":"Samir Bousseaden","status":"test","level":"high","date":"2019-02-16","modified":"2022-09-02","description":"Detects svchost hosting RDP termsvcs communicating with the loopback address","references":["https://twitter.com/SBousseaden/status/1096148422984384514","https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/44fbe85f72ee91582876b49678f9a26292a155fb/Command%20and%20Control/DE_RDP_Tunnel_5156.evtx"],"logsource":{"product":"windows","service":"security"},"tags":["attack.command-and-control","attack.lateral-movement","attack.t1090.001","attack.t1090.002","attack.t1021.001","car.2013-07-002"],"path":"rules/windows/builtin/security/win_security_rdp_reverse_tunnel.yml","techniques":["T1090.001","T1090.002","T1021.001"],"cves":[]},{"id":"8b0e12da-d3c3-49db-bb4f-256703f380e5","title":"PUA - Chisel Tunneling Tool Execution","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-09-13","modified":"2023-02-13","description":"Detects usage of the Chisel tunneling tool via the commandline arguments","references":["https://github.com/jpillora/chisel/","https://arcticwolf.com/resources/blog/lorenz-ransomware-chiseling-in/","https://blog.sekoia.io/lucky-mouse-incident-response-to-detection-engineering/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.command-and-control","attack.t1090.001"],"path":"rules/windows/process_creation/proc_creation_win_pua_chisel.yml","techniques":["T1090.001"],"cves":[]},{"id":"cf93e05e-d798-4d9e-b522-b0248dc61eaf","title":"HackTool - SharpChisel Execution","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-09-05","modified":"2023-02-13","description":"Detects usage of the Sharp Chisel via the commandline arguments","references":["https://github.com/shantanu561993/SharpChisel","https://www.sentinelone.com/labs/wading-through-muddy-waters-recent-activity-of-an-iranian-state-sponsored-threat-actor/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.command-and-control","attack.t1090.001"],"path":"rules/windows/process_creation/proc_creation_win_hktl_sharp_chisel.yml","techniques":["T1090.001"],"cves":[]},{"id":"e0c69ebd-b54f-4aed-8ae3-e3467843f3f0","title":"Renamed Cloudflared.EXE Execution","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-12-20","modified":null,"description":"Detects the execution of a renamed \"cloudflared\" binary.","references":["https://github.com/cloudflare/cloudflared/releases","https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare/","https://github.com/cloudflare/cloudflared","https://www.intrinsec.com/akira_ransomware/","https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.command-and-control","attack.t1090.001"],"path":"rules/windows/process_creation/proc_creation_win_renamed_cloudflared.yml","techniques":["T1090.001"],"cves":[]},{"id":"fadb84f0-4e84-4f6d-a1ce-9ef2bffb6ccd","title":"Cloudflared Portable Execution","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-12-20","modified":null,"description":"Detects the execution of the \"cloudflared\" binary from a non standard location.\n","references":["https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare/","https://github.com/cloudflare/cloudflared","https://www.intrinsec.com/akira_ransomware/","https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/","https://github.com/cloudflare/cloudflared/releases"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.command-and-control","attack.t1090.001"],"path":"rules/windows/process_creation/proc_creation_win_cloudflared_portable_execution.yml","techniques":["T1090.001"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2021-22017","state":"mapped","mapping_types":["primary_impact"]}],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}