Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Proxy

Sub-techniques (4)

ID	Name
.001	Internal Proxy
.002	External Proxy
.003	Multi-hop Proxy
.004	Domain Fronting

Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic. Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.

ID: T1090

Sub-techniques: .001 .002 .003 .004

Tactic(s): Command and Control

Platforms: Linux, macOS, Network, Windows

Data Sources: Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow

Version: 3.1

Created: 31 May 2017

Last Modified: 30 Aug 2021

Name	Description
Procedure Examples
NETWIRE	NETWIRE can implement use of proxies to pivot traffic.(Citation: Red Canary NETWIRE January 2020)
Operation Wocao	Operation Wocao has used a custom proxy tool called "Agent" which has support for multiple hops.(Citation: FoxIT Wocao December 2019)
KOCTOPUS	KOCTOPUS has deployed a modified version of Invoke-Ngrok to expose open local ports to the Internet.(Citation: MalwareBytes LazyScripter Feb 2021)
SDBbot	SDBbot has the ability to use port forwarding to establish a proxy between a target host and C2.(Citation: Proofpoint TA505 October 2019)
SombRAT	SombRAT has the ability to use an embedded SOCKS proxy in C2 communications.(Citation: CISA AR21-126A FIVEHANDS May 2021)
HTRAN	HTRAN can proxy TCP socket connections to obfuscate command and control infrastructure.(Citation: Operation Quantum Entanglement)(Citation: NCSC Joint Report Public Tools)
Sandworm Team	Sandworm Team's BCS-server tool can create an internal proxy server to redirect traffic from the adversary-controlled C2 to internal servers which may not be connected to the internet, but are interconnected locally.(Citation: ESET Telebots Dec 2016)
AuditCred	AuditCred can utilize proxy for communications.(Citation: TrendMicro Lazarus Nov 2018)
ZxShell	ZxShell can set up an HTTP or SOCKS proxy.(Citation: FireEye APT41 Aug 2019)(Citation: Talos ZxShell Oct 2014)
Turla	Turla RPC backdoors have included local UPnP RPC proxies.(Citation: ESET Turla PowerShell May 2019)
HOPLIGHT	HOPLIGHT has multiple proxy options that mask traffic between the malware and the remote operators.(Citation: US-CERT HOPLIGHT Apr 2019)
CopyKittens	CopyKittens has used the AirVPN service for operational activity.(Citation: Microsoft POLONIUM June 2022)
WarzoneRAT	WarzoneRAT has the capability to act as a reverse proxy.(Citation: Check Point Warzone Feb 2020)
LAPSUS$	LAPSUS$ has leverage NordVPN for its egress points when targeting intended victims.(Citation: MSTIC DEV-0537 Mar 2022)
Blue Mockingbird	Blue Mockingbird has used frp, ssf, and Venom to establish SOCKS proxy connections.(Citation: RedCanary Mockingbird May 2020)
Remcos	Remcos uses the infected hosts as SOCKS5 proxies to allow for tunneling and proxying.(Citation: Riskiq Remcos Jan 2018)
BADCALL	BADCALL functions as a proxy server between the victim and C2 server.(Citation: US-CERT BADCALL)
netsh	netsh can be used to set up a proxy tunnel to allow remote host access to an infected host.(Citation: Securelist fileless attacks Feb 2017)
PLEAD	PLEAD has the ability to proxy network communications.(Citation: JPCert PLEAD Downloader June 2018)
Dridex	Dridex contains a backconnect module for tunneling network traffic through a victim's computer. Infected computers become part of a P2P botnet that can relay C2 traffic to other infected peers.(Citation: Dell Dridex Oct 2015)(Citation: Checkpoint Dridex Jan 2021)
HARDRAIN	HARDRAIN uses the command `cmd.exe /c netsh firewall add portopening TCP 443 "adp"` and makes the victim machine function as a proxy server.(Citation: US-CERT HARDRAIN March 2018)
Kessel	Kessel can use a proxy during exfiltration if set in the configuration.(Citation: ESET ForSSHe December 2018)
TSCookie	TSCookie has the ability to proxy communications with command and control (C2) servers.(Citation: JPCert BlackTech Malware September 2019)
Windigo	Windigo has delivered a generic Windows proxy Win32/Glubteta.M. Windigo has also used multiple reverse proxy chains as part of their C2 infrastructure.(Citation: ESET Windigo Mar 2014)
POLONIUM	POLONIUM has used the AirVPN service for operational activity.(Citation: Microsoft POLONIUM June 2022)
PoshC2	PoshC2 contains modules that allow for use of proxies in command and control.(Citation: GitHub PoshC2)
TYPEFRAME	A TYPEFRAME variant can force the compromised system to function as a proxy server.(Citation: US-CERT TYPEFRAME June 2018)
jRAT	jRAT can serve as a SOCKS proxy server.(Citation: Kaspersky Adwind Feb 2016)
Green Lambert	Green Lambert can use proxies for C2 traffic.(Citation: Objective See Green Lambert for OSX Oct 2021)(Citation: Glitch-Cat Green Lambert ATTCK Oct 2021)
FunnyDream	FunnyDream can identify and use configured proxies in a compromised network for C2 communication.(Citation: Bitdefender FunnyDream Campaign November 2020)
	During Operation Wocao, threat actors used a custom proxy tool called "Agent" which has support for multiple hops.(Citation: FoxIT Wocao December 2019)
RainyDay	RainyDay can use proxy tools including boost_proxy_client for reverse proxy functionality.(Citation: Bitdefender Naikon April 2021)
Cardinal RAT	Cardinal RAT can act as a reverse proxy.(Citation: PaloAlto CardinalRat Apr 2017)
Socksbot	Socksbot can start SOCKS proxy threads.(Citation: TrendMicro Patchwork Dec 2017)
Fox Kitten	Fox Kitten has used the open source reverse proxy tools including FRPC and Go Proxy to establish connections from C2 to local servers.(Citation: CISA AA20-259A Iran-Based Actor September 2020)(Citation: ClearSky Pay2Kitten December 2020)(Citation: Check Point Pay2Key November 2020)
Vasport	Vasport is capable of tunneling though a proxy.(Citation: Symantec Vasport May 2012)
QuasarRAT	QuasarRAT can communicate over a reverse proxy using SOCKS5.(Citation: GitHub QuasarRAT)(Citation: Volexity Patchwork June 2018)
Earth Lusca	Earth Lusca adopted Cloudflare as a proxy for compromised servers.(Citation: TrendMicro EarthLusca 2022)
Ursnif	Ursnif has used a peer-to-peer (P2P) network for C2.(Citation: NJCCIC Ursnif Sept 2016)(Citation: ProofPoint Ursnif Aug 2016)
Aria-body	Aria-body has the ability to use a reverse SOCKS proxy module.(Citation: CheckPoint Naikon May 2020)
Bisonal	Bisonal has supported use of a proxy server.(Citation: Talos Bisonal Mar 2020)
APT41	APT41 used a tool called CLASSFON to covertly proxy network communications.(Citation: FireEye APT41 Aug 2019)
XTunnel	XTunnel relays traffic between a C2 server and a victim.(Citation: Crowdstrike DNC June 2016)
Ngrok	Ngrok can be used to proxy connections to machines located behind NAT or firewalls.(Citation: MalwareBytes Ngrok February 2020)(Citation: Zdnet Ngrok September 2018)
	For Operation Sharpshooter, the threat actors used the ExpressVPN service to hide their location.(Citation: Bleeping Computer Op Sharpshooter March 2019)

Mitigation	Description
Mitigations
Filter Network Traffic	Use network appliances to filter ingress or egress traffic and perform protocol-based filtering. Configure software on endpoints to filter network traffic.
Network Intrusion Prevention	Use intrusion detection signatures to block traffic at network boundaries.
SSL/TLS Inspection	Break and inspect SSL/TLS sessions to look at encrypted web traffic for adversary activity.

Detection

Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server or between clients that should not or often do not communicate with one another). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. (Citation: University of Birmingham C2) Consider monitoring for traffic to known anonymity networks (such as Tor).

References

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.