{"id":"T1090.003","name":"Multi-hop Proxy","url":"https://attack.mitre.org/techniques/T1090/003","tactics":["command-and-control"],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0359","stix_id":"x-mitre-detection-strategy--407286ed-c904-412a-9f2d-7426ea7304a4","name":"Multi-hop Proxy Behavior via Relay Node Chaining, Onion Routing, and Network Tunneling","url":"https://attack.mitre.org/detectionstrategies/DET0359","analytics":[{"id":"AN1020","stix_id":"x-mitre-analytic--128315ea-6407-4c28-8528-209e799ad8e1","name":"Analytic 1020","description":"Suspicious processes (e.g., Tor clients, relays, unknown binaries) launch with sustained encrypted outbound traffic to known anonymity infrastructure (e.g., Tor, I2P), and may relay to additional internal systems via reverse proxying, ICMP tunneling, or socket forwarding.","url":"https://attack.mitre.org/detectionstrategies/DET0359#AN1020","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"dns:query","channel":"Outbound resolution to hidden service domains (e.g., `.onion`)","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"dns-query"}],"mutable_elements":[{"field":"DomainCategory","description":"Can be tuned to `.onion`, I2P, or suspicious CDN domains."},{"field":"ProcessParent","description":"Detect known-good vs. abnormal launching binaries (e.g., mshta spawning Tor)."},{"field":"ConnectionDuration","description":"Threshold for persistent connections over known relay ports (e.g., 9050)."}],"live":true,"detection_strategies":["DET0359"],"techniques":["T1090.003"]},{"id":"AN1021","stix_id":"x-mitre-analytic--2416a634-3ad9-4f91-a894-8fb0d9d83b76","name":"Analytic 1021","description":"Tools such as `tor`, `nglite`, `proxychains`, `chisel`, or custom daemons repeatedly initiate outbound sessions to multiple nodes before final destination. This behavior is abnormal for Linux services outside of VPN, monitoring, or CDN relay contexts.","url":"https://attack.mitre.org/detectionstrategies/DET0359#AN1021","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve for proxy tools","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"NSM:Flow","channel":"conn.log + ssl.log with Tor fingerprinting","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"nsm-flow"},{"name":"Netfilter/iptables","channel":"Forwarded packets log","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"netfilter-iptables"}],"mutable_elements":[{"field":"ExecutablePath","description":"Match known proxy tools, tuned for environment."},{"field":"RelayCount","description":"Detect outbound chaining behavior through >2 IPs in short succession."},{"field":"ProtocolType","description":"Allow filtering by ICMP, TCP/443, UDP for obfuscation channels."}],"live":true,"detection_strategies":["DET0359"],"techniques":["T1090.003"]},{"id":"AN1022","stix_id":"x-mitre-analytic--b97a1c6e-bb02-4e14-ae57-6a9e96512657","name":"Analytic 1022","description":"LaunchAgents or LaunchDaemons initiate persistent Tor or relay processes that make encrypted outbound connections. May be paired with sandbox bypasses or unsigned executables communicating over SOCKS proxies.","url":"https://attack.mitre.org/detectionstrategies/DET0359#AN1022","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"process, socket, and DNS logs","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"macos:osquery","channel":"process_events + launchd","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"macos-osquery"},{"name":"macos:unifiedlog","channel":"forwarded encrypted traffic","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"LaunchdLabel","description":"Regex for masking patterns in LaunchAgents with proxy behavior."},{"field":"UnsignedBinary","description":"Allow for exceptions for known unsigned binaries."},{"field":"SOCKSPortUsage","description":"Monitor local 9050/9150 activity and rerouted system traffic."}],"live":true,"detection_strategies":["DET0359"],"techniques":["T1090.003"]},{"id":"AN1023","stix_id":"x-mitre-analytic--08370ff8-9442-42c0-bfb5-c7f5792c74ea","name":"Analytic 1023","description":"Outbound encrypted traffic initiated from hypervisor shell or via VM backdoor mechanisms to relays in VPS infrastructure, especially if traversing multiple nodes before reaching Internet destination. Packet captures or firewall logs show non-VM communication paths.","url":"https://attack.mitre.org/detectionstrategies/DET0359#AN1023","platforms":["ESXi"],"log_source_references":[{"name":"esxi:esxupdate","channel":"/var/log/esxupdate.log or /var/log/vmksummary.log","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"esxi-esxupdate"},{"name":"esxi:vmkernel","channel":"/var/log/vmkernel.log","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"esxi-vmkernel"},{"name":"NSM:Flow","channel":"Relay patterns across IP hops","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"HopCount","description":"Threshold on number of IPs contacted in sequence without DNS resolution."},{"field":"ShellAccess","description":"Flag if relay communication initiated by ESXi shell or unknown VM agent."},{"field":"VPSIPRange","description":"Filter for known Tor/VPS egress networks."}],"live":true,"detection_strategies":["DET0359"],"techniques":["T1090.003"]},{"id":"AN1024","stix_id":"x-mitre-analytic--a691ee45-94bf-4244-a286-b80c21859d2e","name":"Analytic 1024","description":"Encrypted traffic or ICMP tunneling from border routers to internal routers or unknown external IPs. Forwarded traffic shows consistent hop-to-hop relaying without matching configured VPN or expected network topology.","url":"https://attack.mitre.org/detectionstrategies/DET0359#AN1024","platforms":["Network Devices"],"log_source_references":[{"name":"NSM:Flow","channel":"Relayed session pathing (multi-hop)","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"nsm-flow"},{"name":"NSM:Firewall","channel":"Outbound encrypted traffic","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-firewall"},{"name":"networkdevice:syslog","channel":"Custom firmware or routing changes","data_component":"DC0004","data_component_name":"Firmware Modification","log_source_slug":"networkdevice-syslog"}],"mutable_elements":[{"field":"VPNConfigWhitelist","description":"Define allowed internal router communication paths."},{"field":"ICMPPayloadEntropy","description":"High entropy ICMP payloads may indicate tunneling activity."},{"field":"RelayChainSignature","description":"Track known multi-hop pattern signatures or port hopping techniques."}],"live":true,"detection_strategies":["DET0359"],"techniques":["T1090.003"]}],"live":true,"version":"1.0","techniques":["T1090.003"]}],"sigma_rules":[{"id":"62f7c9bf-9135-49b2-8aeb-1e54a6ecc13c","title":"Tor Client/Browser Execution","author":"frack113","status":"test","level":"high","date":"2022-02-20","modified":"2025-10-27","description":"Detects the use of Tor or Tor-Browser to connect to onion routing networks","references":["https://www.logpoint.com/en/blog/detecting-tor-use-with-logpoint/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.command-and-control","attack.t1090.003"],"path":"rules/windows/process_creation/proc_creation_win_browsers_tor_execution.yml","techniques":["T1090.003"],"cves":[]},{"id":"8384bd26-bde6-4da9-8e5d-4174a7a47ca2","title":"Query Tor Onion Address - DNS Client","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-02-20","modified":"2025-09-12","description":"Detects DNS resolution of an .onion address related to Tor routing networks","references":["https://www.logpoint.com/en/blog/detecting-tor-use-with-logpoint/","https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/ASimDNS/imDNS_TorProxies.yaml"],"logsource":{"product":"windows","service":"dns-client"},"tags":["attack.command-and-control","attack.t1090.003"],"path":"rules/windows/builtin/dns_client/win_dns_client_tor_onion.yml","techniques":["T1090.003"],"cves":[]},{"id":"b55ca2a3-7cff-4dda-8bdd-c7bfa63bf544","title":"DNS Query Tor .Onion Address - Sysmon","author":"frack113","status":"test","level":"high","date":"2022-02-20","modified":"2025-09-12","description":"Detects DNS queries to an \".onion\" address related to Tor routing networks","references":["https://www.logpoint.com/en/blog/detecting-tor-use-with-logpoint/","https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/ASimDNS/imDNS_TorProxies.yaml"],"logsource":{"product":"windows","category":"dns_query"},"tags":["attack.command-and-control","attack.t1090.003"],"path":"rules/windows/dns_query/dns_query_win_tor_onion_domain_query.yml","techniques":["T1090.003"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}