Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Detection Strategies DET0445 — Detection of Proxy Infrastructure Setup and Traffic Bridging
DET0445

Detection of Proxy Infrastructure Setup and Traffic Bridging

5 analytic(s) · 1 technique(s) detected

Analytics

5
AN1229 Analytic 1229
Windows

Suspicious process spawning (e.g., `rundll32`, `svchost`, `powershell`, or `netsh`) followed by network connection creation to internal hosts or uncommon external endpoints on high or non-standard ports.

WinEventLog:Sysmon EventCode=3, 22 WinEventLog:Sysmon EventCode=1 NSM:Connections Outbound Connection
[ParentProcessName] Legitimate system processes that may rarely spawn network-capable child processes (e.g., `rundll32`, `svchost`).
[DestinationPort] Watch for high-numbered ports or well-known proxy ports like 1080, 8080, 4444.
[TimeWindow] Capture unusual spikes in outbound connections over a short period.
AN1230 Analytic 1230
Linux

User-space tools (e.g., `socat`, `ncat`, `iptables`, `ssh`) used in non-standard ways to establish reverse shells, port-forwarding, or inter-host connections. Often chained with uncommon outbound destinations or SSH tunnels.

auditd:SYSCALL execve NSM:Flow Connection Tracking
[CommandLinePattern] Shell piping into tools like `socat`, `ncat`, or `openssl` for tunnel creation.
[OutboundPortRange] Flag connections made from internal systems to uncommon high ports externally.
[ProcessUserContext] Capture low-privilege or unexpected users executing system-level network tools.
AN1231 Analytic 1231
macOS

AppleScript, LaunchAgents, or remote login services (`ssh`, `networksetup`) establishing proxy tunnels or dynamic port forwards to external IPs or alternate local hosts.

macos:unifiedlog None NSM:Firewall pf firewall logs NSM:Flow connection attempts
[TargetDomain] Identify suspicious domains often associated with CDN-routed or anonymized endpoints (e.g., Cloudflare, Fastly).
[AppleScriptUsage] Alert when AppleScript or Automator tools are used for network tunneling tasks.
[LaunchAgentSource] Monitor for LaunchAgents executing proxy tools or dynamic ports.
AN1232 Analytic 1232
ESXi

Direct use of `nc`, `socat`, or reverse tunnel scripts initiated by abnormal user contexts or unauthorized VIBs initiating connections from hypervisor to external systems.

esxi:shell None esxi:vmkernel None NSM:Flow conn.log
[CLICommand] Custom proxy or port forwarding scripts executed from ESXi shell.
[DestinationIP] Unusual outbound connections from ESXi host, particularly to internet.
[UserContext] Root or elevated users initiating unexpected tunnels.
AN1233 Analytic 1233
Network Devices

Dynamic or static port forwarding rules added to route traffic through an internal host, or configuration changes to proxy firewall rules not aligned with baselined policy.

NSM:Firewall Policy Change / Rule Update NSM:Flow Flow Creation (NetFlow/sFlow) networkdevice:cli Interface commands
[RuleType] Focus on new allow/permit rules with dynamic NAT or port forwarders.
[ChangeUser] Flag any non-admins initiating proxy config changes.
[FlowVolumeDelta] Detect sharp changes in bi-directional traffic patterns.

Detected Techniques

1

Command & Control (1)

Details

MITRE ID
DET0445
STIX ID
x-mitre-detection-strategy--5c44619a-da36-4bbd-9730-efceacf2409f
Analytics
5
Techniques Detected
1
By Tactic
Command & Control
1
Leaving Threaticon

This link opens an external site that isn't part of the platform.