MITRE ATT&CK - Техника Внешний прокси-сервер

Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Наш канал

Proxy: Внешний прокси-сервер

Other sub-techniques of Proxy (4)

ID	Название
.001	Внутренний прокси-сервер
.002	Внешний прокси-сервер
.003	Цепочка прокси-серверов
.004	Домен-прикрытие

Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths to avoid suspicion. External connection proxies are used to mask the destination of C2 traffic and are typically implemented with port redirectors. Compromised systems outside of the victim environment may be used for these purposes, as well as purchased infrastructure such as cloud-based resources or virtual private servers. Proxies may be chosen based on the low likelihood that a connection to them from a compromised system would be investigated. Victim systems would communicate directly with the external proxy on the Internet and then the proxy would forward communications to the C2 server.

ID: T1090.002

Относится к технике: T1090

Тактика(-и): Command and Control

Платформы: Linux, macOS, Windows

Источники данных: Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow

Версия: 1.0

Дата создания: 14 Mar 2020

Последнее изменение: 27 Mar 2020

Название	Описание
Примеры процедур
APT39	APT39 has used various tools to proxy C2 communications.(Citation: BitDefender Chafer May 2020)
ShimRat	ShimRat can use pre-configured HTTP proxies.(Citation: FOX-IT May 2016 Mofang)
QakBot	QakBot has a module that can proxy C2 communications.(Citation: Kaspersky QakBot September 2021)
APT28	APT28 used other victims as proxies to relay command traffic, for instance using a compromised Georgian military email server as a hop point to NATO victims. The group has also used a tool that acts as a proxy to allow C2 even if the victim is behind a router. APT28 has also used a machine to relay and obscure communications between CHOPSTICK and their server.(Citation: FireEye APT28)(Citation: Bitdefender APT28 Dec 2015)(Citation: DOJ GRU Indictment Jul 2018)
FIN5	FIN5 maintains access to victim environments by using FLIPSIDE to create a proxy for a backup RDP tunnel.(Citation: Mandiant FIN5 GrrCON Oct 2016)
Tonto Team	Tonto Team has routed their traffic through an external server in order to obfuscate their location.(Citation: TrendMicro Tonto Team October 2020)
Mythic	Mythic can leverage a modified SOCKS5 proxy to tunnel egress C2 traffic.(Citation: Mythc Documentation)
Winnti for Windows	The Winnti for Windows HTTP/S C2 mode can make use of an external proxy.(Citation: Novetta Winnti April 2015)
Lazarus Group	Lazarus Group has used multiple proxies to obfuscate network traffic from victims.(Citation: US-CERT FALLCHILL Nov 2017)(Citation: TrendMicro macOS Dacls May 2020)
menuPass	menuPass has used a global service provider's IP as a proxy for C2 traffic from a victim.(Citation: FireEye APT10 April 2017)(Citation: FireEye APT10 Sept 2018)
APT3	An APT3 downloader establishes SOCKS5 connections for its initial C2.(Citation: FireEye Operation Double Tap)
Regin	Regin leveraged several compromised universities as proxies to obscure its origin.(Citation: Kaspersky Regin)
POWERSTATS	POWERSTATS has connected to C2 servers through proxies.(Citation: FireEye MuddyWater Mar 2018)
Silence	Silence has used ProxyBot, which allows the attacker to redirect traffic from the current node to the backconnect server via Sock4\Socks5.(Citation: Group IB Silence Sept 2018)
Okrum	Okrum can identify proxy servers configured and used by the victim, and use it to make HTTP requests to C2 its server.(Citation: ESET Okrum July 2019)
GALLIUM	GALLIUM used a modified version of HTRAN to redirect connections between networks.(Citation: Cybereason Soft Cell June 2019)
MuddyWater	MuddyWater has controlled POWERSTATS from behind a proxy network to obfuscate the C2 location.(Citation: Symantec MuddyWater Dec 2018) MuddyWater has used a series of compromised websites that victims connected to randomly to relay information to command and control (C2).(Citation: Reaqta MuddyWater November 2017)(Citation: Trend Micro Muddy Water March 2021)
TrickBot	TrickBot has been known to reach a command and control server via one of nine proxy IP addresses. (Citation: Bitdefender Trickbot C2 infra Nov 2020) (Citation: Bitdefender Trickbot VNC module Whitepaper 2021)
InvisiMole	InvisiMole InvisiMole can identify proxy servers used by the victim and use them for C2 communication.(Citation: ESET InvisiMole June 2018)(Citation: ESET InvisiMole June 2020)

Контрмера	Описание
Контрмеры
Network Intrusion Prevention	Use intrusion detection signatures to block traffic at network boundaries.

Обнаружение

Analyze network data for uncommon data flows, such as a client sending significantly more data than it receives from an external server. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.(Citation: University of Birmingham C2)

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.