Cross-source coverage

T1090.002 / ATT&CK

Proxy: External Proxy

8 rules across 3 sources.

From MITRE ATT&CK 19.2

Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths to avoid suspicion.

External connection proxies are used to mask the destination of C2 traffic and are typically implemented with port redirectors. Compromised systems outside of the victim environment may be used for these purposes, as well as purchased infrastructure such as cloud-based resources or virtual private servers. Proxies may be chosen based on the low likelihood that a connection to them from a compromised system would be investigated. Victim systems would communicate directly with the external proxy on the Internet and then the proxy would forward communications to the C2 server.

Tactics: Command and Control
Platforms: ESXi · Linux · macOS · Network Devices · Windows
Telemetry: WinEventLog:SysmonWinEventLog:Microsoft-Windows-Windows Defender/Operationalauditd:SYSCALLNSM:Flowmacos:unifiedlogmacos:osqueryesxi:shellesxi:vmkernelFirewall Audit Logsnetworkdevice:syslog

How MITRE says to detect it DET0325

External Proxy Behavior via Outbound Relay to Intermediate Infrastructure

Windows Analytic 0922

Unusual process (e.g., `rundll32`, `mshta`, `wscript`, or custom payloads) initiates network connection to external IPs/domains that proxy C2 traffic, often over uncommon ports or high entropy HTTP/S connections.

WinEventLog:Sysmon EventCode=3, 22
WinEventLog:Sysmon EventCode=1
WinEventLog:Microsoft-Windows-Windows Defender/Operational Unusual external domain access

Linux Analytic 0923

`curl`, `wget`, `ncat`, `socat`, or custom binaries initiate outbound traffic to Internet-based proxies (e.g., via VPS or CDN). Behavior may include reverse shell constructs or persistent outbound beacons.

auditd:SYSCALL execve
NSM:Flow conn.log or http.log
NSM:Flow alert log

macOS Analytic 0924

AppleScript or terminal sessions launch tools (`curl`, `nc`, `ssh`) to external IPs not commonly accessed. Outbound connections are made by LaunchAgents/LaunchDaemons, often masquerading as system services.

macos:unifiedlog process logs
NSM:Flow pf firewall logs
macos:osquery launchd or network_events

ESXi Analytic 0925

ESXi shell or guest VM tools initiate external connections via scripted traffic forwarding to Internet-based proxies. Detected by firewall or shell audit logs showing outbound connection spikes from hypervisor or guest VM to remote proxy nodes.

esxi:shell None
esxi:vmkernel None
NSM:Flow conn.log

Network Devices Analytic 0926

Changes to NAT/firewall policies enabling outbound port forwarding from internal IPs to Internet-based proxy endpoints. Log spikes in outbound flows to CDN, VPS, or anomalous ASNs with few return packets.

Firewall Audit Logs Outbound NAT Rule Changes
NSM:Flow Outbound flow records
networkdevice:syslog Dynamic route changes

View on attack.mitre.org ↗

elastic/detection-rules

5 rules

Detection	Severity	Format
Curl SOCKS Proxy Activity from Unusual Parent	Medium	Elastic TOML
Potential Protocol Tunneling via Cloudflared	Medium	Elastic TOML
Connection to Commonly Abused Web Services	Low	Elastic TOML
DNS Request to Suspicious Top Level Domain	Low	Elastic TOML
Potential SSH Reverse Port Forwarding	Low	Elastic TOML

SigmaHQ/sigma

2 rules

Detection	Severity	Format
RDP over Reverse SSH Tunnel WFP	High	Sigma
Network Communication Initiated To Portmap.IO Domain	Medium	Sigma

splunk/security_content

1 rule

Detection	Severity	Format
Cisco Secure Firewall - Connection to File Sharing Domain	Undefined	SPL