Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Прокси-сервер

Sub-techniques (4)

ID	Name
.001	Внутренний прокси-сервер
.002	Внешний прокси-сервер
.003	Цепочка прокси-серверов
.004	Домен-прикрытие

Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic. Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.

ID: T1090

Суб-техники: .001 .002 .003 .004

Тактика(-и): Command and Control

Платформы: ESXi, Linux, macOS, Network Devices, Windows

Источники данных: Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow

Версия: 3.2

Дата создания: 31 May 2017

Последнее изменение: 25 Apr 2025

Название	Описание
Примеры процедур
Sagerunex	Sagerunex uses several proxy configuration settings to ensure connectivity.(Citation: Cisco LotusBlossom 2025)
NETWIRE	NETWIRE can implement use of proxies to pivot traffic.(Citation: Red Canary NETWIRE January 2020)
Operation Wocao	Operation Wocao has used a custom proxy tool called "Agent" which has support for multiple hops.(Citation: FoxIT Wocao December 2019)
ZIPLINE	ZIPLINE can create a proxy server on compromised hosts.(Citation: Mandiant Cutting Edge January 2024)(Citation: Mandiant Cutting Edge Part 2 January 2024)
RansomHub	RansomHub can use a proxy to connect to remote SFTP servers.(Citation: Group-IB RansomHub FEB 2025)
KOCTOPUS	KOCTOPUS has deployed a modified version of Invoke-Ngrok to expose open local ports to the Internet.(Citation: MalwareBytes LazyScripter Feb 2021)
Volt Typhoon	Volt Typhoon has used compromised devices and customized versions of open source tools such as FRP (Fast Reverse Proxy), Earthworm, and Impacket to proxy network traffic.(Citation: Microsoft Volt Typhoon May 2023)(Citation: Joint Cybersecurity Advisory Volt Typhoon June 2023)(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)
SDBbot	SDBbot has the ability to use port forwarding to establish a proxy between a target host and C2.(Citation: Proofpoint TA505 October 2019)
SombRAT	SombRAT has the ability to use an embedded SOCKS proxy in C2 communications.(Citation: CISA AR21-126A FIVEHANDS May 2021)
HTRAN	HTRAN can proxy TCP socket connections to obfuscate command and control infrastructure.(Citation: Operation Quantum Entanglement)(Citation: NCSC Joint Report Public Tools)
FRP	FRP can proxy communications through a server in public IP space to local servers located behind a NAT or firewall.(Citation: FRP GitHub)
	Mustang Panda proxied communication through the Cloudflare CDN service during RedDelta Modified PlugX Infection Chain Operations.(Citation: Recorded Future RedDelta 2025)
Sandworm Team	Sandworm Team's BCS-server tool can create an internal proxy server to redirect traffic from the adversary-controlled C2 to internal servers which may not be connected to the internet, but are interconnected locally.(Citation: ESET Telebots Dec 2016)
AuditCred	AuditCred can utilize proxy for communications.(Citation: TrendMicro Lazarus Nov 2018)
ZxShell	ZxShell can set up an HTTP or SOCKS proxy.(Citation: FireEye APT41 Aug 2019)(Citation: Talos ZxShell Oct 2014)
Turla	Turla RPC backdoors have included local UPnP RPC proxies.(Citation: ESET Turla PowerShell May 2019)
	During Operation MidnightEclipse, threat actors used the GO Simple Tunnel reverse proxy tool.(Citation: Volexity UPSTYLE 2024)
HOPLIGHT	HOPLIGHT has multiple proxy options that mask traffic between the malware and the remote operators.(Citation: US-CERT HOPLIGHT Apr 2019)
CopyKittens	CopyKittens has used the AirVPN service for operational activity.(Citation: Microsoft POLONIUM June 2022)
WarzoneRAT	WarzoneRAT has the capability to act as a reverse proxy.(Citation: Check Point Warzone Feb 2020)
ngrok	ngrok can be used to proxy connections to machines located behind NAT or firewalls.(Citation: MalwareBytes Ngrok February 2020)(Citation: Zdnet Ngrok September 2018)
LITTLELAMB.WOOLTEA	LITTLELAMB.WOOLTEA has the ability to function as a SOCKS proxy.(Citation: Mandiant Cutting Edge Part 3 February 2024)
LAPSUS$	LAPSUS$ has leverage NordVPN for its egress points when targeting intended victims.(Citation: MSTIC DEV-0537 Mar 2022)
Blue Mockingbird	Blue Mockingbird has used FRP, ssf, and Venom to establish SOCKS proxy connections.(Citation: RedCanary Mockingbird May 2020)
Neo-reGeorg	Neo-reGeorg has the ability to establish a SOCKS5 proxy on a compromised web server.(Citation: GitHub Neo-reGeorg 2019)
Cinnamon Tempest	Cinnamon Tempest has used a customized version of the Iox port-forwarding and proxy tool.(Citation: Sygnia Emperor Dragonfly October 2022)
Remcos	Remcos uses the infected hosts as SOCKS5 proxies to allow for tunneling and proxying.(Citation: Riskiq Remcos Jan 2018)
BADCALL	BADCALL functions as a proxy server between the victim and C2 server.(Citation: US-CERT BADCALL)
BADHATCH	BADHATCH can use SOCKS4 and SOCKS5 proxies to connect to actor-controlled C2 servers. BADHATCH can also emulate a reverse proxy on a compromised machine to connect with actor-controlled C2 servers.(Citation: BitDefender BADHATCH Mar 2021)
GoBear	GoBear implements SOCKS5 proxy functionality.(Citation: S2W Troll Stealer 2024)
netsh	netsh can be used to set up a proxy tunnel to allow remote host access to an infected host.(Citation: Securelist fileless attacks Feb 2017)
MoustachedBouncer	MoustachedBouncer has used a reverse proxy tool similar to the GitHub repository revsocks.(Citation: MoustachedBouncer ESET August 2023)
PLEAD	PLEAD has the ability to proxy network communications.(Citation: JPCert PLEAD Downloader June 2018)
Dridex	Dridex contains a backconnect module for tunneling network traffic through a victim's computer. Infected computers become part of a P2P botnet that can relay C2 traffic to other infected peers.(Citation: Dell Dridex Oct 2015)(Citation: Checkpoint Dridex Jan 2021)
HARDRAIN	HARDRAIN uses the command `cmd.exe /c netsh firewall add portopening TCP 443 "adp"` and makes the victim machine function as a proxy server.(Citation: US-CERT HARDRAIN March 2018)
Kessel	Kessel can use a proxy during exfiltration if set in the configuration.(Citation: ESET ForSSHe December 2018)
TSCookie	TSCookie has the ability to proxy communications with command and control (C2) servers.(Citation: JPCert BlackTech Malware September 2019)
Windigo	Windigo has delivered a generic Windows proxy Win32/Glubteta.M. Windigo has also used multiple reverse proxy chains as part of their C2 infrastructure.(Citation: ESET Windigo Mar 2014)
POLONIUM	POLONIUM has used the AirVPN service for operational activity.(Citation: Microsoft POLONIUM June 2022)
PoshC2	PoshC2 contains modules that allow for use of proxies in command and control.(Citation: GitHub PoshC2)
TYPEFRAME	A TYPEFRAME variant can force the compromised system to function as a proxy server.(Citation: US-CERT TYPEFRAME June 2018)
reGeorg	reGeorg can establish an HTTP or SOCKS proxy to tunnel data in and out of a network.(Citation: GitHub reGeorg 2016)(Citation: Fortinet reGeorg MAR 2019)(Citation: Mandiant APT29 Eye Spy Email Nov 22)
	During C0017, APT41 used the Cloudflare CDN to proxy C2 traffic.(Citation: Mandiant APT41)
jRAT	jRAT can serve as a SOCKS proxy server.(Citation: Kaspersky Adwind Feb 2016)
Green Lambert	Green Lambert can use proxies for C2 traffic.(Citation: Objective See Green Lambert for OSX Oct 2021)(Citation: Glitch-Cat Green Lambert ATTCK Oct 2021)
FunnyDream	FunnyDream can identify and use configured proxies in a compromised network for C2 communication.(Citation: Bitdefender FunnyDream Campaign November 2020)
	During Operation Wocao, threat actors used a custom proxy tool called "Agent" which has support for multiple hops.(Citation: FoxIT Wocao December 2019)
RainyDay	RainyDay can use proxy tools including boost_proxy_client for reverse proxy functionality.(Citation: Bitdefender Naikon April 2021)
Cardinal RAT	Cardinal RAT can act as a reverse proxy.(Citation: PaloAlto CardinalRat Apr 2017)
Socksbot	Socksbot can start SOCKS proxy threads.(Citation: TrendMicro Patchwork Dec 2017)
Fox Kitten	Fox Kitten has used the open source reverse proxy tools including FRPC and Go Proxy to establish connections from C2 to local servers.(Citation: CISA AA20-259A Iran-Based Actor September 2020)(Citation: ClearSky Pay2Kitten December 2020)(Citation: Check Point Pay2Key November 2020)
Vasport	Vasport is capable of tunneling though a proxy.(Citation: Symantec Vasport May 2012)
QuasarRAT	QuasarRAT can communicate over a reverse proxy using SOCKS5.(Citation: GitHub QuasarRAT)(Citation: Volexity Patchwork June 2018)
Kapeka	Kapeka can identify system proxy settings via `WinHttpGetIEProxyConfigForCurrentUser()` during initialization and utilize these settings for subsequent command and control operations.(Citation: WithSecure Kapeka 2024)
Earth Lusca	Earth Lusca adopted Cloudflare as a proxy for compromised servers.(Citation: TrendMicro EarthLusca 2022)
Magic Hound	Magic Hound has used Fast Reverse Proxy (FRP) for RDP traffic.(Citation: DFIR Phosphorus November 2021)
Ursnif	Ursnif has used a peer-to-peer (P2P) network for C2.(Citation: NJCCIC Ursnif Sept 2016)(Citation: ProofPoint Ursnif Aug 2016)
Aria-body	Aria-body has the ability to use a reverse SOCKS proxy module.(Citation: CheckPoint Naikon May 2020)
Bisonal	Bisonal has supported use of a proxy server.(Citation: Talos Bisonal Mar 2020)
APT41	APT41 used a tool called CLASSFON to covertly proxy network communications.(Citation: FireEye APT41 Aug 2019)
XTunnel	XTunnel relays traffic between a C2 server and a victim.(Citation: Crowdstrike DNC June 2016)
LunarWeb	LunarWeb has the ability to use a HTTP proxy server for C&C communications.(Citation: ESET Turla Lunar toolset May 2024)
Samurai	Samurai has the ability to proxy connections to specified remote IPs and ports through a a proxy module.(Citation: Kaspersky ToddyCat June 2022)
Ngrok	Ngrok can be used to proxy connections to machines located behind NAT or firewalls.(Citation: MalwareBytes Ngrok February 2020)(Citation: Zdnet Ngrok September 2018)
KEYPLUG	KEYPLUG has used Cloudflare CDN associated infrastructure to redirect C2 communications to malicious domains.(Citation: Mandiant APT41)
	During C0027, Scattered Spider installed the open-source rsocx reverse proxy tool on a targeted ESXi appliance.(Citation: Crowdstrike TELCO BPO Campaign December 2022)
	For Operation Sharpshooter, the threat actors used the ExpressVPN service to hide their location.(Citation: Bleeping Computer Op Sharpshooter March 2019)

Контрмера	Описание
Контрмеры
Filter Network Traffic	Employ network appliances and endpoint software to filter ingress, egress, and lateral network traffic. This includes protocol-based filtering, enforcing firewall rules, and blocking or restricting traffic based on predefined conditions to limit adversary movement and data exfiltration. This mitigation can be implemented through the following measures: Ingress Traffic Filtering: - Use Case: Configure network firewalls to allow traffic only from authorized IP addresses to public-facing servers. - Implementation: Limit SSH (port 22) and RDP (port 3389) traffic to specific IP ranges. Egress Traffic Filtering: - Use Case: Use firewalls or endpoint security software to block unauthorized outbound traffic to prevent data exfiltration and command-and-control (C2) communications. - Implementation: Block outbound traffic to known malicious IPs or regions where communication is unexpected. Protocol-Based Filtering: - Use Case: Restrict the use of specific protocols that are commonly abused by adversaries, such as SMB, RPC, or Telnet, based on business needs. - Implementation: Disable SMBv1 on endpoints to prevent exploits like EternalBlue. Network Segmentation: - Use Case: Create network segments for critical systems and restrict communication between segments unless explicitly authorized. - Implementation: Implement VLANs to isolate IoT devices or guest networks from core business systems. Application Layer Filtering: - Use Case: Use proxy servers or Web Application Firewalls (WAFs) to inspect and block malicious HTTP/S traffic. - Implementation: Configure a WAF to block SQL injection attempts or other web application exploitation techniques.
Network Intrusion Prevention	Use intrusion detection signatures to block traffic at network boundaries.
SSL/TLS Inspection	SSL/TLS inspection involves decrypting encrypted network traffic to examine its content for signs of malicious activity. This capability is crucial for detecting threats that use encryption to evade detection, such as phishing, malware, or data exfiltration. After inspection, the traffic is re-encrypted and forwarded to its destination. This mitigation can be implemented through the following measures: Deploy SSL/TLS Inspection Appliances: - Implement SSL/TLS inspection solutions to decrypt and inspect encrypted traffic. - Ensure appliances are placed at critical network choke points for maximum coverage. Configure Decryption Policies: - Define rules to decrypt traffic for specific applications, ports, or domains. - Avoid decrypting sensitive or privacy-related traffic, such as financial or healthcare websites, to comply with regulations. Integrate Threat Intelligence: - Use threat intelligence feeds to correlate inspected traffic with known indicators of compromise (IOCs). Integrate with Security Tools: - Combine SSL/TLS inspection with SIEM and NDR tools to analyze decrypted traffic and generate alerts for suspicious activity. - Example Tools: Splunk, Darktrace Implement Certificate Management: - Use trusted internal or third-party certificates for traffic re-encryption after inspection. - Regularly update certificate authorities (CAs) to ensure secure re-encryption. Monitor and Tune: - Continuously monitor SSL/TLS inspection logs for anomalies and fine-tune policies to reduce false positives.

Обнаружение

Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server or between clients that should not or often do not communicate with one another). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. (Citation: University of Birmingham C2) Consider monitoring for traffic to known anonymity networks (such as Tor).

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.