Techniques › T1090 › T1090.002

T1090.002 External Proxy

command and control — ESXi, Linux, macOS, Network Devices, Windows · attack.mitre.org · JSON

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

• DET0325 External Proxy Behavior via Outbound Relay to Intermediate Infrastructure v1.0
  AN0922 Windows

  Unusual process (e.g., rundll32, mshta, wscript, or custom payloads) initiates network connection to external IPs/domains that proxy C2 traffic, often over uncommon ports or high entropy HTTP/S connections.

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Microsoft-Windows-Windows Defender/Operational Unusual external domain access → DC0085 Network Traffic Content

  Tunable: DestinationASN ParentProcess EntropyThreshold
  AN0923 Linux

  curl, wget, ncat, socat, or custom binaries initiate outbound traffic to Internet-based proxies (e.g., via VPS or CDN). Behavior may include reverse shell constructs or persistent outbound beacons.

  auditd:SYSCALL execve → DC0032 Process Creation

  NSM:Flow conn.log or http.log → DC0085 Network Traffic Content

  NSM:Flow alert log → DC0078 Network Traffic Flow

  Tunable: CommandLinePattern ExternalIPList UserContext
  AN0924 macOS

  AppleScript or terminal sessions launch tools (curl, nc, ssh) to external IPs not commonly accessed. Outbound connections are made by LaunchAgents/LaunchDaemons, often masquerading as system services.

  macos:unifiedlog process logs → DC0032 Process Creation

  NSM:Flow pf firewall logs → DC0078 Network Traffic Flow

  macos:osquery launchd or network_events → DC0082 Network Connection Creation

  Tunable: LaunchAgentPath ExternalPort ProcessReputation
  AN0925 ESXi

  ESXi shell or guest VM tools initiate external connections via scripted traffic forwarding to Internet-based proxies. Detected by firewall or shell audit logs showing outbound connection spikes from hypervisor or guest VM to remote proxy nodes.

  esxi:shell None → DC0032 Process Creation

  esxi:vmkernel None → DC0078 Network Traffic Flow

  NSM:Flow conn.log → DC0082 Network Connection Creation

  Tunable: VMOutboundPatterns ProxyHostPattern ConnectionDirectionality
  AN0926 Network Devices

  Changes to NAT/firewall policies enabling outbound port forwarding from internal IPs to Internet-based proxy endpoints. Log spikes in outbound flows to CDN, VPS, or anomalous ASNs with few return packets.

  Firewall Audit Logs Outbound NAT Rule Changes → DC0051 Firewall Rule Modification

  NSM:Flow Outbound flow records → DC0078 Network Traffic Flow

  networkdevice:syslog Dynamic route changes → DC0082 Network Connection Creation

  Tunable: FlowThreshold DestinationIPCategory ConfigChangeUser

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1090.002

Rules tagged at the parent level (attack.t1090) 22

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.