T1090 Proxy
Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap.…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Communication To LocaltoNet Tunneling Service Initiatedhightest · windows
- Communication To LocaltoNet Tunneling Service Initiated - Linuxhightest · linux
- Communication To Ngrok Tunneling Service - Linuxhightest · linux
- Communication To Ngrok Tunneling Service Initiatedhightest · windows
- DNS Query Tor .Onion Address - Sysmonhightest · windows
- HackTool - Htran/NATBypass Executionhightest · windows
- HackTool - SharpChisel Executionhightest · windows
- Malicious IP Address Sign-In Failure Ratehightest · azure
- Malicious IP Address Sign-In Suspicioushightest · azure
- Ngrok Usage with Remote Desktop Servicehightest · windows
- OpenCanary - HTTPPROXY Login Attempthightest · opencanary
- PUA - Chisel Tunneling Tool Executionhightest · windows
- PUA - Fast Reverse Proxy (FRP) Executionhightest · windows
- PUA - NPS Tunneling Tool Executionhightest · windows
- PUA- IOX Tunneling Tool Executionhightest · windows
- Query Tor Onion Address - DNS Clienthightest · windows
- RDP Port Forwarding Rule Added Via Netsh.EXEhightest · windows
- RDP over Reverse SSH Tunnel WFPhightest · windows
- Renamed Cloudflared.EXE Executionhightest · windows
- Sign-In From Malware Infected IPhightest · azure
- Tor Client/Browser Executionhightest · windows
- Kalambur Backdoor Curl TOR SOCKS Proxy Executionhighexperimental · windows
- Cloudflared Portable Executionmediumtest · windows
- Cloudflared Quick Tunnel Executionmediumtest · windows
- Cloudflared Tunnel Connections Cleanupmediumtest · windows
Showing 25 of 31.
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.