Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. ^[1] Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.

Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.

ID: T1090

Sub-techniques: T1090.001, T1090.002, T1090.003, T1090.004

Tactic: Command And Control

Platforms: Linux, Network, Windows, macOS

Data Sources: Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection

Contributors: Brian Prange; Heather Linn; Walker Johnson

Version: 3.1

Created: 31 May 2017

Last Modified: 21 October 2020

Version Permalink

Live Version

Procedure Examples

Name	Description
APT41	APT41 used a tool called CLASSFON to covertly proxy network communications.^[2]
Aria-body	Aria-body has the ability to use a reverse SOCKS proxy module.^[3]
AuditCred	AuditCred can utilize proxy for communications.^[4]
BADCALL	BADCALL functions as a proxy server between the victim and C2 server.^[5]
Blue Mockingbird	Blue Mockingbird has used frp, ssf, and Venom to establish SOCKS proxy connections.^[6]
Cardinal RAT	Cardinal RAT can act as a reverse proxy.^[7]
Dridex	Dridex contains a backconnect module for tunneling network traffic through a victim's computer. Infected computers become part of a P2P botnet that can relay C2 traffic to other infected peers.^[8]
HARDRAIN	HARDRAIN uses the command `cmd.exe /c netsh firewall add portopening TCP 443 "adp"` and makes the victim machine function as a proxy server.^[9]
HOPLIGHT	HOPLIGHT has multiple proxy options that mask traffic between the malware and the remote operators.^[10]
HTRAN	HTRAN can proxy TCP socket connections to obfuscate command and control infrastructure.^[11]^[12]
jRAT	jRAT can serve as a SOCKS proxy server.^[13]
Kessel	Kessel can use a proxy during exfiltration if set in the configuration.^[14]
netsh	netsh can be used to set up a proxy tunnel to allow remote host access to an infected host.^[15]
Ngrok	Ngrok can be used to proxy connections to machines located behind NAT or firewalls.^[16]^[17]
PLEAD	PLEAD has the ability to proxy network communications.^[18]
PoshC2	PoshC2 contains modules that allow for use of proxies in command and control.^[19]
QuasarRAT	QuasarRAT can communicate over a reverse proxy using SOCKS5.^[20]^[21]
Remcos	Remcos uses the infected hosts as SOCKS5 proxies to allow for tunneling and proxying.^[22]
Sandworm Team	Sandworm Team's BCS-server tool can create an internal proxy server to redirect traffic from the adversary-controlled C2 to internal servers which may not be connected to the internet, but are interconnected locally.^[23]
SDBot	SDBot has the ability to use port forwarding to establish a proxy between a target host and C2.^[24]
Socksbot	Socksbot can start SOCKS proxy threads.^[25]
TSCookie	TSCookie has the ability to proxy communications with command and control (C2) servers.^[26]
Turla	Turla RPC backdoors have included local UPnP RPC proxies.^[27]
TYPEFRAME	A TYPEFRAME variant can force the compromised system to function as a proxy server.^[28]
Ursnif	Ursnif has used a peer-to-peer (P2P) network for C2.^[29]^[30]
Vasport	Vasport is capable of tunneling though a proxy.^[31]
XTunnel	XTunnel relays traffic between a C2 server and a victim.^[32]
ZxShell	ZxShell can set up an HTTP or SOCKS proxy.^[2]^[33]

Mitigations

Mitigation	Description
Filter Network Traffic	Traffic to known anonymity networks and C2 infrastructure can be blocked through the use of network allow and block lists. It should be noted that this kind of blocking may be circumvented by other techniques like Domain Fronting.
Network Intrusion Prevention	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific C2 protocol used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. ^[34]
SSL/TLS Inspection	If it is possible to inspect HTTPS traffic, the captures can be analyzed for connections that appear to be domain fronting.

Detection

Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server or between clients that should not or often do not communicate with one another). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. ^[34]

Consider monitoring for traffic to known anonymity networks (such as Tor).

Proxy

Sub-techniques (4)

Procedure Examples

Mitigations

Detection

References