{"id":"T1090.002","name":"External Proxy","url":"https://attack.mitre.org/techniques/T1090/002","tactics":["command-and-control"],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0325","stix_id":"x-mitre-detection-strategy--bfb5cb12-7025-44c3-9a2d-79cfe42ecf54","name":"External Proxy Behavior via Outbound Relay to Intermediate Infrastructure","url":"https://attack.mitre.org/detectionstrategies/DET0325","analytics":[{"id":"AN0922","stix_id":"x-mitre-analytic--99b2296f-dc1c-4b0e-a05a-883a0dbb1535","name":"Analytic 0922","description":"Unusual process (e.g., `rundll32`, `mshta`, `wscript`, or custom payloads) initiates network connection to external IPs/domains that proxy C2 traffic, often over uncommon ports or high entropy HTTP/S connections.","url":"https://attack.mitre.org/detectionstrategies/DET0325#AN0922","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Microsoft-Windows-Windows Defender/Operational","channel":"Unusual external domain access","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"wineventlog-microsoft-windows-windows-defender-operational"}],"mutable_elements":[{"field":"DestinationASN","description":"Adjust for known benign but high-risk infrastructure (e.g., hosting providers like DigitalOcean, OVH, etc.)."},{"field":"ParentProcess","description":"Detect suspicious lineage—proxy tools launched from script interpreters or LOLBins."},{"field":"EntropyThreshold","description":"Tune based on expected randomness in outbound request payloads."}],"live":true,"detection_strategies":["DET0325"],"techniques":["T1090.002"]},{"id":"AN0923","stix_id":"x-mitre-analytic--9a0c2390-f8e9-4f03-ae21-0e1e876fed89","name":"Analytic 0923","description":"`curl`, `wget`, `ncat`, `socat`, or custom binaries initiate outbound traffic to Internet-based proxies (e.g., via VPS or CDN). Behavior may include reverse shell constructs or persistent outbound beacons.","url":"https://attack.mitre.org/detectionstrategies/DET0325#AN0923","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"NSM:Flow","channel":"conn.log or http.log","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"},{"name":"NSM:Flow","channel":"alert log","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"CommandLinePattern","description":"Regex or command substring matches indicative of dynamic proxy setup."},{"field":"ExternalIPList","description":"Tunable list of IPs or ASNs related to known proxy/VPS abuse."},{"field":"UserContext","description":"Unexpected users running networking tools (e.g., www-data, apache)."}],"live":true,"detection_strategies":["DET0325"],"techniques":["T1090.002"]},{"id":"AN0924","stix_id":"x-mitre-analytic--cd7fee55-79e6-42f4-9c68-e653cc8a1d24","name":"Analytic 0924","description":"AppleScript or terminal sessions launch tools (`curl`, `nc`, `ssh`) to external IPs not commonly accessed. Outbound connections are made by LaunchAgents/LaunchDaemons, often masquerading as system services.","url":"https://attack.mitre.org/detectionstrategies/DET0325#AN0924","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"process logs","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"NSM:Flow","channel":"pf firewall logs","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"nsm-flow"},{"name":"macos:osquery","channel":"launchd or network_events","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"macos-osquery"}],"mutable_elements":[{"field":"LaunchAgentPath","description":"Detect persistence used to restart proxy after reboot."},{"field":"ExternalPort","description":"Often high or non-standard ports, configurable for outbound proxy detection."},{"field":"ProcessReputation","description":"Flag unsigned or anomalous binaries making external connections."}],"live":true,"detection_strategies":["DET0325"],"techniques":["T1090.002"]},{"id":"AN0925","stix_id":"x-mitre-analytic--0c8a9540-51d7-4ba3-8594-8860b3fa8485","name":"Analytic 0925","description":"ESXi shell or guest VM tools initiate external connections via scripted traffic forwarding to Internet-based proxies. Detected by firewall or shell audit logs showing outbound connection spikes from hypervisor or guest VM to remote proxy nodes.","url":"https://attack.mitre.org/detectionstrategies/DET0325#AN0925","platforms":["ESXi"],"log_source_references":[{"name":"esxi:shell","channel":"None","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"esxi-shell"},{"name":"esxi:vmkernel","channel":"None","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"esxi-vmkernel"},{"name":"NSM:Flow","channel":"conn.log","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"VMOutboundPatterns","description":"Detect when VMs communicate with Internet IPs not in workload profiles."},{"field":"ProxyHostPattern","description":"Regex for proxy-related tools/scripts executed on the host."},{"field":"ConnectionDirectionality","description":"Outbound only connections from ESXi to new IPs."}],"live":true,"detection_strategies":["DET0325"],"techniques":["T1090.002"]},{"id":"AN0926","stix_id":"x-mitre-analytic--bca44b88-4615-45b8-8fb9-ce934c65c8be","name":"Analytic 0926","description":"Changes to NAT/firewall policies enabling outbound port forwarding from internal IPs to Internet-based proxy endpoints. Log spikes in outbound flows to CDN, VPS, or anomalous ASNs with few return packets.","url":"https://attack.mitre.org/detectionstrategies/DET0325#AN0926","platforms":["Network Devices"],"log_source_references":[{"name":"Firewall Audit Logs","channel":"Outbound NAT Rule Changes","data_component":"DC0051","data_component_name":"Firewall Rule Modification","log_source_slug":"firewall-audit-logs"},{"name":"NSM:Flow","channel":"Outbound flow records","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"nsm-flow"},{"name":"networkdevice:syslog","channel":"Dynamic route changes","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"networkdevice-syslog"}],"mutable_elements":[{"field":"FlowThreshold","description":"Number of flows or bytes transferred per minute—flag surges to unrecognized ASNs."},{"field":"DestinationIPCategory","description":"Proxy destination categories: CDN, TOR exit node, anonymous hosting."},{"field":"ConfigChangeUser","description":"Track if unexpected user or automation changed NAT/forwarding rules."}],"live":true,"detection_strategies":["DET0325"],"techniques":["T1090.002"]}],"live":true,"version":"1.0","techniques":["T1090.002"]}],"sigma_rules":[{"id":"07837ab9-60e1-481f-a74d-c31fb496a94c","title":"Network Communication Initiated To Portmap.IO Domain","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2024-05-31","modified":null,"description":"Detects an executable accessing the portmap.io domain, which could be a sign of forbidden C2 traffic or data exfiltration by malicious actors","references":["https://portmap.io/","https://github.com/rapid7/metasploit-framework/issues/11337","https://pro.twitter.com/JaromirHorejsi/status/1795001037746761892/photo/2"],"logsource":{"product":"windows","category":"network_connection"},"tags":["attack.t1041","attack.command-and-control","attack.t1090.002","attack.exfiltration"],"path":"rules/windows/network_connection/net_connection_win_domain_portmap.yml","techniques":["T1041","T1090.002"],"cves":[]},{"id":"5bed80b6-b3e8-428e-a3ae-d3c757589e41","title":"RDP over Reverse SSH Tunnel WFP","author":"Samir Bousseaden","status":"test","level":"high","date":"2019-02-16","modified":"2022-09-02","description":"Detects svchost hosting RDP termsvcs communicating with the loopback address","references":["https://twitter.com/SBousseaden/status/1096148422984384514","https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/44fbe85f72ee91582876b49678f9a26292a155fb/Command%20and%20Control/DE_RDP_Tunnel_5156.evtx"],"logsource":{"product":"windows","service":"security"},"tags":["attack.command-and-control","attack.lateral-movement","attack.t1090.001","attack.t1090.002","attack.t1021.001","car.2013-07-002"],"path":"rules/windows/builtin/security/win_security_rdp_reverse_tunnel.yml","techniques":["T1090.001","T1090.002","T1021.001"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}