Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Detection Strategies DET0325 — External Proxy Behavior via Outbound Relay to Intermediate Infrastructure
DET0325

External Proxy Behavior via Outbound Relay to Intermediate Infrastructure

5 analytic(s) · 1 technique(s) detected

Analytics

5
AN0922 Analytic 0922
Windows

Unusual process (e.g., `rundll32`, `mshta`, `wscript`, or custom payloads) initiates network connection to external IPs/domains that proxy C2 traffic, often over uncommon ports or high entropy HTTP/S connections.

WinEventLog:Sysmon EventCode=3, 22 WinEventLog:Sysmon EventCode=1 WinEventLog:Microsoft-Windows-Windows Defender/Operational Unusual external domain access
[DestinationASN] Adjust for known benign but high-risk infrastructure (e.g., hosting providers like DigitalOcean, OVH, etc.).
[ParentProcess] Detect suspicious lineage—proxy tools launched from script interpreters or LOLBins.
[EntropyThreshold] Tune based on expected randomness in outbound request payloads.
AN0923 Analytic 0923
Linux

`curl`, `wget`, `ncat`, `socat`, or custom binaries initiate outbound traffic to Internet-based proxies (e.g., via VPS or CDN). Behavior may include reverse shell constructs or persistent outbound beacons.

auditd:SYSCALL execve NSM:Flow conn.log or http.log NSM:Flow alert log
[CommandLinePattern] Regex or command substring matches indicative of dynamic proxy setup.
[ExternalIPList] Tunable list of IPs or ASNs related to known proxy/VPS abuse.
[UserContext] Unexpected users running networking tools (e.g., www-data, apache).
AN0924 Analytic 0924
macOS

AppleScript or terminal sessions launch tools (`curl`, `nc`, `ssh`) to external IPs not commonly accessed. Outbound connections are made by LaunchAgents/LaunchDaemons, often masquerading as system services.

macos:unifiedlog process logs NSM:Flow pf firewall logs macos:osquery launchd or network_events
[LaunchAgentPath] Detect persistence used to restart proxy after reboot.
[ExternalPort] Often high or non-standard ports, configurable for outbound proxy detection.
[ProcessReputation] Flag unsigned or anomalous binaries making external connections.
AN0925 Analytic 0925
ESXi

ESXi shell or guest VM tools initiate external connections via scripted traffic forwarding to Internet-based proxies. Detected by firewall or shell audit logs showing outbound connection spikes from hypervisor or guest VM to remote proxy nodes.

esxi:shell None esxi:vmkernel None NSM:Flow conn.log
[VMOutboundPatterns] Detect when VMs communicate with Internet IPs not in workload profiles.
[ProxyHostPattern] Regex for proxy-related tools/scripts executed on the host.
[ConnectionDirectionality] Outbound only connections from ESXi to new IPs.
AN0926 Analytic 0926
Network Devices

Changes to NAT/firewall policies enabling outbound port forwarding from internal IPs to Internet-based proxy endpoints. Log spikes in outbound flows to CDN, VPS, or anomalous ASNs with few return packets.

Firewall Audit Logs Outbound NAT Rule Changes NSM:Flow Outbound flow records networkdevice:syslog Dynamic route changes
[FlowThreshold] Number of flows or bytes transferred per minute—flag surges to unrecognized ASNs.
[DestinationIPCategory] Proxy destination categories: CDN, TOR exit node, anonymous hosting.
[ConfigChangeUser] Track if unexpected user or automation changed NAT/forwarding rules.

Detected Techniques

1

Command & Control (1)

Details

MITRE ID
DET0325
STIX ID
x-mitre-detection-strategy--bfb5cb12-7025-44c3-9a2d-79cfe42ecf54
Analytics
5
Techniques Detected
1
By Tactic
Command & Control
1
Leaving Threaticon

This link opens an external site that isn't part of the platform.