Techniques › T1090 › T1090.003

T1090.003 Multi-hop Proxy

command and control — ESXi, Linux, macOS, Network Devices, Windows · attack.mitre.org · JSON

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

• DET0359 Multi-hop Proxy Behavior via Relay Node Chaining, Onion Routing, and Network Tunneling v1.0
  AN1020 Windows

  Suspicious processes (e.g., Tor clients, relays, unknown binaries) launch with sustained encrypted outbound traffic to known anonymity infrastructure (e.g., Tor, I2P), and may relay to additional internal systems via reverse proxying, ICMP tunneling, or socket forwarding.

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  dns:query Outbound resolution to hidden service domains (e.g., `.onion`) → DC0078 Network Traffic Flow

  Tunable: DomainCategory ProcessParent ConnectionDuration
  AN1021 Linux

  Tools such as tor, nglite, proxychains, chisel, or custom daemons repeatedly initiate outbound sessions to multiple nodes before final destination. This behavior is abnormal for Linux services outside of VPN, monitoring, or CDN relay contexts.

  auditd:SYSCALL execve for proxy tools → DC0032 Process Creation

  NSM:Flow conn.log + ssl.log with Tor fingerprinting → DC0078 Network Traffic Flow

  Netfilter/iptables Forwarded packets log → DC0085 Network Traffic Content

  Tunable: ExecutablePath RelayCount ProtocolType
  AN1022 macOS

  LaunchAgents or LaunchDaemons initiate persistent Tor or relay processes that make encrypted outbound connections. May be paired with sandbox bypasses or unsigned executables communicating over SOCKS proxies.

  macos:unifiedlog process, socket, and DNS logs → DC0032 Process Creation

  macos:osquery process_events + launchd → DC0082 Network Connection Creation

  macos:unifiedlog forwarded encrypted traffic → DC0078 Network Traffic Flow

  Tunable: LaunchdLabel UnsignedBinary SOCKSPortUsage
  AN1023 ESXi

  Outbound encrypted traffic initiated from hypervisor shell or via VM backdoor mechanisms to relays in VPS infrastructure, especially if traversing multiple nodes before reaching Internet destination. Packet captures or firewall logs show non-VM communication paths.

  esxi:esxupdate /var/log/esxupdate.log or /var/log/vmksummary.log → DC0082 Network Connection Creation

  esxi:vmkernel /var/log/vmkernel.log → DC0078 Network Traffic Flow

  NSM:Flow Relay patterns across IP hops → DC0085 Network Traffic Content

  Tunable: HopCount ShellAccess VPSIPRange
  AN1024 Network Devices

  Encrypted traffic or ICMP tunneling from border routers to internal routers or unknown external IPs. Forwarded traffic shows consistent hop-to-hop relaying without matching configured VPN or expected network topology.

  NSM:Flow Relayed session pathing (multi-hop) → DC0078 Network Traffic Flow

  NSM:Firewall Outbound encrypted traffic → DC0085 Network Traffic Content

  networkdevice:syslog Custom firmware or routing changes → DC0004 Firmware Modification

  Tunable: VPNConfigWhitelist ICMPPayloadEntropy RelayChainSignature

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1090.003

Rules tagged at the parent level (attack.t1090) 22

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.