T1090.001 Internal Proxy
Sub-technique of T1090 Proxy
Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap.(Citation: Trend Micro APT Attack Tools) Adversaries use internal proxies to manage command and…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- HackTool - SharpChisel Executionhightest · windows
- PUA - Chisel Tunneling Tool Executionhightest · windows
- RDP over Reverse SSH Tunnel WFPhightest · windows
- Renamed Cloudflared.EXE Executionhightest · windows
- Cloudflared Portable Executionmediumtest · windows
- Cloudflared Quick Tunnel Executionmediumtest · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.