MITRE ATT&CK technique · Command and Control

`T1090.002` External Proxy

Sub-technique of T1090 Proxy

Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries…

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

APT28

Sigma rules to hunt it

RDP over Reverse SSH Tunnel WFPhightest · windows
Network Communication Initiated To Portmap.IO Domainmediumtest · windows

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.