Techniques › T1572
T1572 Protocol Tunneling
command and control — ESXi, Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
24
Sigma rules tagged attack.t1572
0
KEV CVEs mapped here
<p>Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet.</p><p>There are various means to encapsulate a protocol within another protocol. For example, adversaries may perform SSH tunneling (also known as SSH port forwarding), which involves forwarding arbitrary data over an encrypted SSH tunnel.</p><p>Protocol Tunneling may also be abused by adversaries during Dynamic Resolution. Known as DNS over HTTPS (DoH), queries to resolve C2 infrastructure may be encapsulated within encrypted HTTPS packets.</p><p>Adversaries may also leverage Protocol Tunneling in conjunction with Proxy and/or Protocol or Service Impersonation to further conceal C2 communications and infrastructure.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0538 Detection Strategy for Protocol Tunneling accross OS platforms. v1.0
AN1483 WindowsProcesses such as plink.exe, ssh.exe, or netsh.exe establishing outbound network connections where traffic patterns show encapsulated protocols (e.g., RDP over SSH). Defender observations include anomalous process-to-network relationships, large asymmetric data flows, and port usage mismatches.Tunable:
AllowedToolsDataAsymmetryThresholdTimeWindowAN1484 Linuxsshd, socat, or custom binaries initiating port forwarding or encapsulating traffic (e.g., RDP, SMB) through SSH or HTTP. Defender sees abnormal connect/bind syscalls, encrypted traffic on ports typically used for non-encrypted services, and outlier traffic volume patterns.auditd:SYSCALLsocket/connect calls showing SSH processes forwarding arbitrary ports→ DC0082 Network Connection CreationTunable:ForwardingFlagsProtocolBaselineAN1485 macOSlaunchd or user-invoked processes (ssh, socat) encapsulating traffic via SSH tunnels, VPN-style tooling, or DNS-over-HTTPS clients. Defender sees outbound TLS traffic with embedded DNS or RDP payloads.macos:unifiedlogencrypted outbound traffic carrying unexpected application data→ DC0085 Network Traffic ContentTunable:ExpectedDoHResolversPayloadEntropyThresholdAN1486 ESXiVMware daemons or user processes encapsulating traffic (e.g., guest VMs tunneling via hostd). Defender sees network services inside ESXi creating flows inconsistent with management plane traffic, such as SSH forwarding or DNS-over-HTTPS from management interfaces.esxcli:networklistening sockets bound with non-standard encapsulated protocols→ DC0085 Network Traffic ContentTunable:ESXiServiceProfiles
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1572
Author: Florian Roth (Nextron Systems)
· 2022-07-16 (modified 2025-07-30) · logsource: product=windows category=network_connection · 18249279-932f-45e2-b37a-8925f2597670
Detects an executable initiating a network connection to "ngrok" domains.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Author: Florian Roth (Nextron Systems)
· 2022-11-03 · logsource: product=linux category=network_connection · 19bf6fdb-7721-4f3d-867f-53467f6a5db6
Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors
Author: citron_ninja
· 2023-10-25 (modified 2023-11-20) · logsource: product=windows category=dns_query · 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b
Detects DNS query requests to Devtunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Author: Florian Roth (Nextron Systems)
· 2022-11-03 (modified 2024-02-02) · logsource: product=windows category=network_connection · 1d08ac94-400d-4469-a82f-daee9a908849
Detects an executable initiating a network connection to "ngrok" tunneling domains.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-10-12 (modified 2024-03-05) · logsource: product=windows category=process_creation · 327f48c1-a6db-4eb8-875a-f6981f1b0183
Detects port forwarding activity via SSH.exe
Author: Andreas Braathen (mnemonic.io)
· 2024-06-17 · logsource: product=windows category=network_connection · 3ab65069-d82a-4d44-a759-466661a082d1
Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains.
LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet.
Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.
Author: Alina Stepchenkova, Group-IB, oscd.community
· 2019-11-01 (modified 2023-04-03) · logsource: product=windows category=ps_script · 3ceb2083-a27f-449a-be33-14ec1b7cc973
Detects Silence EmpireDNSAgent as described in the Group-IP report
Author: Florian Roth (Nextron Systems)
· 2021-01-19 (modified 2022-10-09) · logsource: product=windows category=process_creation · 48a61b29-389f-4032-b317-b30de6b95314
Detects suspicious Plink tunnel port forwarding to a local port
Author: Kamran Saifullah
· 2023-11-20 · logsource: product=windows category=network_connection · 4b657234-038e-4ad5-997c-4be42340bce4
Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Author: Samir Bousseaden
· 2019-02-16 (modified 2024-03-12) · logsource: product=windows category=network_connection · 5f699bc5-5446-4a4a-a0b7-5ef2885a3eb4
Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389
Author: Muhammad Faisal (@faisalusuf), Hunter Juhan (@threatHNTR)
· 2024-06-03 · logsource: product=windows category=process_creation · 5fc297ae-25b6-488a-8f25-cc12ac29b744
Detects potentially suspicious execution of the Qemu utility in a Windows environment.
Threat actors have leveraged this utility and this technique for achieving network access as reported by Kaspersky.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-05-17 (modified 2023-12-21) · logsource: product=windows category=process_creation · 7050bba1-1aed-454e-8f73-3f46f09ce56a
Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.
Author: Kamran Saifullah, Nasreddine Bencherchali (Nextron Systems)
· 2024-05-27 · logsource: product=windows category=network_connection · 7cd1dcdc-6edf-4896-86dc-d1f19ad64903
Detects network connections to Cloudflared tunnels domains initiated by a process on the system.
Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Author: Kamran Saifullah
· 2023-11-20 · logsource: product=windows category=network_connection · 9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4
Detects network connections to Devtunnels domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Author: Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems)
· 2023-05-17 (modified 2023-12-20) · logsource: product=windows category=process_creation · 9a019ffc-3580-4c9d-8d87-079f7e8d3fd4
Detects execution of the "cloudflared" tool to connect back to a tunnel. This was seen used by threat actors to maintain persistence and remote access to compromised networks.
Author: Kamran Saifullah
· 2024-09-13 · logsource: product=windows category=network_connection · 9e02c8ec-02b9-43e8-81eb-34a475ba7965
Detects network connections to BTunnels domains initiated by a process on the system.
Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-12-20 · logsource: product=windows category=dns_query · a1d9eec5-33b2-4177-8d24-27fe754d0812
Detects DNS requests to Cloudflared tunnels domains.
Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Author: Florian Roth (Nextron Systems)
· 2022-04-29 (modified 2022-07-14) · logsource: product=windows category=network_connection · b1e5da3b-ca8e-4adf-915c-9921f3d85481
Detects svchost hosting RDP termsvcs communicating to target systems on TCP port 80 or 443
Author: Andreas Braathen (mnemonic.io)
· 2024-06-17 · logsource: product=linux category=network_connection · c4568f5d-131f-4e78-83d4-45b2da0ec4f1
Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains.
LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet.
Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.
Author: Daniil Yugoslavskiy, oscd.community
· 2019-10-24 (modified 2024-01-18) · logsource: product=windows category=process_creation · c75309a3-59f8-4a8d-9c2c-4c927ad50555
Detects the execution of well known tools that can be abused for data exfiltration and tunneling.
Author: Florian Roth (Nextron Systems)
· 2021-05-14 (modified 2023-02-21) · logsource: product=windows category=process_creation · ee37eb7c-a4e7-4cd5-8fa4-efa27f1c3f31
Detects the use of Ngrok, a utility used for port forwarding and tunneling, often used by threat actors to make local protected services publicly available.
Involved domains are bin.equinox.io for download and *.ngrok.io for connections.
Author: Florian Roth (Nextron Systems)
· 2022-09-13 (modified 2023-02-21) · logsource: product=windows category=process_creation · f38a82d2-fba3-4781-b549-525efbec8506
Detects the use of 3proxy, a tiny free proxy server
Author: Florian Roth (Nextron Systems)
· 2022-08-04 (modified 2023-01-27) · logsource: product=windows category=process_creation · f38ce0b9-5e97-4b47-a211-7dc8d8b871da
Execution of plink to perform data exfiltration and tunneling
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-10-12 (modified 2023-01-25) · logsource: product=windows category=process_creation · f7d7ebd5-a016-46e2-9c54-f9932f2d386d
Execution of ssh.exe to perform data exfiltration and tunneling through RDP