T1572 Protocol Tunneling
Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Silence.EDA Detectioncriticaltest · windows
- Communication To LocaltoNet Tunneling Service Initiatedhightest · windows
- Communication To LocaltoNet Tunneling Service Initiated - Linuxhightest · linux
- Communication To Ngrok Tunneling Service - Linuxhightest · linux
- Communication To Ngrok Tunneling Service Initiatedhightest · windows
- PUA - 3Proxy Executionhightest · windows
- PUA - Ngrok Executionhightest · windows
- Potential RDP Tunneling Via Plinkhightest · windows
- Potential RDP Tunneling Via SSHhightest · windows
- Process Initiated Network Connection To Ngrok Domainhightest · windows
- RDP Over Reverse SSH Tunnelhightest · windows
- RDP to HTTP or HTTPS Target Portshightest · windows
- Suspicious Plink Port Forwardinghightest · windows
- Cloudflared Tunnel Connections Cleanupmediumtest · windows
- Cloudflared Tunnel Executionmediumtest · windows
- Cloudflared Tunnels Related DNS Requestsmediumtest · windows
- DNS Query To Devtunnels Domainmediumtest · windows
- Network Connection Initiated To BTunnels Domainsmediumtest · windows
- Network Connection Initiated To Cloudflared Tunnels Domainsmediumtest · windows
- Network Connection Initiated To DevTunnels Domainmediumtest · windows
- Network Connection Initiated To Visual Studio Code Tunnels Domainmediumtest · windows
- Port Forwarding Activity Via SSH.EXEmediumtest · windows
- Potentially Suspicious Usage Of Qemumediumtest · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.