malware

FLIPSIDE S0173

Type: malware
Platform: Windows
Created: 16 January 2018
Last modified: 25 April 2025

FLIPSIDE is a simple tool similar to Plink that is used by FIN5 to maintain access to victims. [1]

TechniqueBottom 5%

TacticBottom 6%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

FLIPSIDE MITRE reference S0173

Protocol Tunneling T1572 ↗

FLIPSIDE uses RDP to tunnel traffic from a victim environment.2

Command and Control37 detection rules

Standing S0173

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Technique1Bottom 5%

5th percentile · 95% of 825 ATT&CK software entries have more Enterprise techniques.

Tactic1Bottom 6%

6th percentile · 94% of 825 ATT&CK software entries have more tactics spanned.

Threat group161% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns085% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique37medTop 16%

84th percentile · 84% of 825 ATT&CK software entries have this many detection rules per technique or fewer.

Tests / technique9medTop 19%

81st percentile · 81% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.

Data comps / technique5med54% tie · 11 values

54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.

Mitigations / technique2medTop 9%

91st percentile · 91% of 825 ATT&CK software entries have this many mitigations per technique or fewer.

5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 1 Enterprise technique.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 24Splunk ESCU (cumulative) · 13

Standing S0173

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
Splunk	This analytic detects creation of a Cisco IOS-XE tunnel interface with tunnel source, tunnel destination, and an IP address in the 10.10.12.0 network. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Command and Control Protocol Tunneling Command and Control Proxy	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	8654314d-8e4d-4971-9f35-b9d477bf668e
	Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-05-17	2023-12-21	7050bba1-1aed-454e-8f73-3f46f09ce56a
	Detects execution of the "cloudflared" tool to connect back to a tunnel. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	medium	Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems)	2023-05-17	2023-12-20	9a019ffc-3580-4c9d-8d87-079f7e8d3fd4
	Detects DNS requests to Cloudflared tunnels domains. (...)	Generic	test	dns	windows	Sysmon	Command and Control Application Layer Protocol Web Protocols Command and Control Protocol Tunneling	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-12-20	—	a1d9eec5-33b2-4177-8d24-27fe754d0812
	Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. (...)	Generic	test	network_connection	windows	Sysmon	Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	high	Andreas Braathen (mnemonic.io)	2024-06-17	—	3ab65069-d82a-4d44-a759-466661a082d1
	Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. (...)	Generic	test	network_connection	linux	Sysmon	Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	high	Andreas Braathen (mnemonic.io)	2024-06-17	—	c4568f5d-131f-4e78-83d4-45b2da0ec4f1
	Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfi (...)	Generic	test	network_connection	linux	Sysmon	Command and Control Dynamic Resolution Domain Generation Algorithms Exfiltration Exfiltration Over Web Service Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	high	Florian Roth (Nextron Systems)	2022-11-03	—	19bf6fdb-7721-4f3d-867f-53467f6a5db6
	Detects an executable initiating a network connection to "ngrok" tunneling domains. (...)	Generic	test	network_connection	windows	Sysmon	Command and Control Dynamic Resolution Domain Generation Algorithms Exfiltration Exfiltration Over Web Service Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	high	Florian Roth (Nextron Systems)	2022-11-03	2024-02-02	1d08ac94-400d-4469-a82f-daee9a908849
	Detects DNS query requests to Devtunnels domains. (...)	Generic	test	dns	windows	Sysmon	Command and Control Application Layer Protocol Web Protocols Command and Control Protocol Tunneling	-	medium	citron_ninja	2023-10-25	2023-11-20	1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b
Splunk	The following analytic detects the use of Ngrok on a Linux operating system. (...)	Anomaly	stable	process_creation	linux	Sysmon	Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	medium	Michael Haag, Splunk	2023-01-12	2026-05-13	bc84d574-708c-467d-b78a-4c1e20171f97
	Detects network connections to BTunnels domains initiated by a process on the system. (...)	Generic	test	network_connection	windows	Sysmon	Exfiltration Exfiltration Over Web Service Command and Control Protocol Tunneling	-	medium	Kamran Saifullah	2024-09-13	—	9e02c8ec-02b9-43e8-81eb-34a475ba7965
	Detects network connections to Cloudflared tunnels domains initiated by a process on the system. (...)	Generic	test	network_connection	windows	Sysmon	Exfiltration Exfiltration Over Web Service Command and Control Protocol Tunneling	-	medium	Kamran Saifullah, Nasreddine Bencherchali (Nextron Systems)	2024-05-27	—	7cd1dcdc-6edf-4896-86dc-d1f19ad64903
	Detects network connections to Devtunnels domains initiated by a process on a system. (...)	Generic	test	network_connection	windows	Sysmon	Exfiltration Exfiltration Over Web Service Exfiltration to Code Repository Command and Control Protocol Tunneling	-	medium	Kamran Saifullah	2023-11-20	—	9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4
	Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. (...)	Generic	test	network_connection	windows	Sysmon	Exfiltration Exfiltration Over Web Service Command and Control Protocol Tunneling	-	medium	Kamran Saifullah	2023-11-20	—	4b657234-038e-4ad5-997c-4be42340bce4
Splunk	The following analytic detects DNS queries to common Ngrok domains, indicating potential use of the Ngrok reverse proxy tool. (...)	Anomaly	stable	dns	windows	Sysmon	Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	medium	Michael Haag, Splunk	2022-11-16	2026-05-13	5790a766-53b8-40d3-a696-3547b978fcf0
Splunk	Remote Employment Fraud (REF) actors will often use virtual private networks (VPNs) to conceal their true physical location. (...)	Generic	experimental	authentication	-	Okta	Command and Control Protocol Tunneling Command and Control Proxy Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Marissa Bower, Raven Tait	2025-06-12	2026-05-13	58eb9f80-896c-42f8-86c6-27ab59026c9c	-
	Detects port forwarding activity via SSH.exe	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Protocol Tunneling Lateral Movement Remote Services Remote Desktop Protocol SSH	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-10-12	2024-03-05	327f48c1-a6db-4eb8-875a-f6981f1b0183
	Execution of plink to perform data exfiltration and tunneling	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Protocol Tunneling	-	high	Florian Roth (Nextron Systems)	2022-08-04	2023-01-27	f38ce0b9-5e97-4b47-a211-7dc8d8b871da
	Execution of ssh.exe to perform data exfiltration and tunneling through RDP	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Protocol Tunneling	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-10-12	2023-01-25	f7d7ebd5-a016-46e2-9c54-f9932f2d386d
	Detects potentially suspicious execution of the Qemu utility in a Windows environment. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Protocol Tunneling Command and Control Proxy	-	medium	Muhammad Faisal (@faisalusuf), Hunter Juhan (@threatHNTR)	2024-06-03	—	5fc297ae-25b6-488a-8f25-cc12ac29b744
	Detects an executable initiating a network connection to "ngrok" domains. (...)	Generic	test	network_connection	windows	Sysmon	Exfiltration Exfiltration Over Web Service Command and Control Protocol Tunneling Command and Control Web Service	CVE-2023-38831	high	Florian Roth (Nextron Systems)	2022-07-16	2025-07-30	18249279-932f-45e2-b37a-8925f2597670
	Detects the use of 3proxy, a tiny free proxy server	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Protocol Tunneling	-	high	Florian Roth (Nextron Systems)	2022-09-13	2023-02-21	f38a82d2-fba3-4781-b549-525efbec8506
	Detects the use of Ngrok, a utility used for port forwarding and tunneling, often used by threat actors to make local protected services publicly available. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Protocol Tunneling	-	high	Florian Roth (Nextron Systems)	2021-05-14	2023-02-21	ee37eb7c-a4e7-4cd5-8fa4-efa27f1c3f31
	Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389	Generic	test	network_connection	windows	Sysmon	Command and Control Protocol Tunneling Lateral Movement Remote Services Remote Desktop Protocol	-	high	Samir Bousseaden	2019-02-16	2024-03-12	5f699bc5-5446-4a4a-a0b7-5ef2885a3eb4
	Detects svchost hosting RDP termsvcs communicating to target systems on TCP port 80 or 443	Generic	test	network_connection	windows	Sysmon	Command and Control Protocol Tunneling Lateral Movement Remote Services Remote Desktop Protocol	-	high	Florian Roth (Nextron Systems)	2022-04-29	2022-07-14	b1e5da3b-ca8e-4adf-915c-9921f3d85481
	Detects Silence EmpireDNSAgent as described in the Group-IP report	Generic	test	ps_script	windows	PowerShell	Command and Control Application Layer Protocol DNS Execution Command and Scripting Interpreter PowerShell Command and Control Protocol Tunneling Impact System Shutdown/Reboot	-	critical	Alina Stepchenkova, Group-IB, oscd.community	2019-11-01	2023-04-03	3ceb2083-a27f-449a-be33-14ec1b7cc973
Splunk	The following analytic detects the execution of the socat utility with command-line arguments that configure a TCP or OpenSSL listener and bind an executable to incoming connections. (...)	Generic	stable	process_creation	linux	Osquery · Sysmon	Execution Command and Scripting Interpreter Command and Control Protocol Tunneling	-	medium	Maria Jose Erquiaga, Splunk	2026-08-27	2026-08-27	72482d45-1d05-46f5-bb6c-e2b709a8073a
Splunk	The following analytic detects execution of the socat utility with a remote TCP or OpenSSL connection and local terminal echo disabled. (...)	Anomaly	stable	process_creation	linux	Osquery · Sysmon	Execution Command and Scripting Interpreter Command and Control Protocol Tunneling	-	medium	Maria Jose Erquiaga, Splunk	2026-08-27	2026-08-27	458c6c37-116d-4f01-8267-f09f5b82cd14
	Detects suspicious Plink tunnel port forwarding to a local port	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Protocol Tunneling Lateral Movement Remote Services Remote Desktop Protocol	-	high	Florian Roth (Nextron Systems)	2021-01-19	2022-10-09	48a61b29-389f-4032-b317-b30de6b95314
	Detects the execution of well known tools that can be abused for data exfiltration and tunneling.	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Application Layer Protocol Web Protocols Exfiltration Exfiltration Over C2 Channel Command and Control Protocol Tunneling	-	medium	Daniil Yugoslavskiy, oscd.community	2019-10-24	2024-01-18	c75309a3-59f8-4a8d-9c2c-4c927ad50555
Splunk	The following analytic detects SSH connections presenting client banners that do not match known, common SSH client software by leveraging Zeek ssh logs. (...)	Anomaly	stable	network_connection	-	Zeek	Command and Control Protocol Tunneling Lateral Movement Remote Services SSH	-	medium	Raven Tait, Splunk	2026-10-12	2026-10-12	93d0f598-d65f-4c97-b030-5bb0af51a226
Splunk	The following analytic detects the execution of ngrok.exe on a Windows operating system. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	medium	Michael Haag, Splunk	2022-11-16	2026-10-09	e2549f2c-0aef-408a-b0c1-e0f270623436
Splunk	This analytic detects network connection events possibly associated with the Cloudflared tool, a tool used to create tunnels via Cloudflare. (...)	Hunting	stable	network_connection	windows	Sysmon	Command and Control Protocol Tunneling	-	medium	Raven Tait, Splunk	2026-05-05	2026-05-13	29798d45-c9c7-4240-a5ef-d7648c016024
Splunk	This analytic detects command-line arguments associated with the cloudflared client used to create Cloudflare tunnels. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Command and Control Protocol Tunneling	-	medium	Raven Tait, Splunk	2026-05-05	2026-05-13	2e29b58e-0f5a-42fc-b435-0fdce8862831
Splunk	This analytic detects the use of Plink (including renamed versions like pvhost.exe) for protocol tunneling, which may be used for egress or lateral movement within an organization. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Command and Control Protocol Tunneling Lateral Movement Remote Services SSH	-	medium	Michael Haag, Splunk	2022-06-17	2026-05-13	8aac5e1e-0fab-4437-af0b-c6e60af23eed
Splunk	Flax Typhoon actors have been identified downloading and using SoftEther VPN software to obfuscate their activity. (...)	Generic	stable	process_creation	windows	Sysmon	Stealth Masquerading Command and Control Protocol Tunneling	-	medium	Raven Tait, Splunk	2026-05-05	2026-05-13	69fe4cb7-807e-4012-a17f-cd288215b038
Splunk	This detection identifies potential abuse of SSH "ProxyCommand" or "LocalCommand" by monitoring for suspicious process execution patterns. (...)	Anomaly	stable	process_creation	windows	Sysmon	Execution Command and Scripting Interpreter PowerShell Command and Control Ingress Tool Transfer Command and Control Protocol Tunneling	-	medium	Michael Haag, AJ King, Nasreddine Bencherchali, Splunk, Jesse Hunter, Splunk Community Contributor	2025-03-24	2026-10-09	ac520039-21f1-4567-b528-5b7133dba76f

Title

Description

FLIPSIDE S0173

FLIPSIDE MITRE reference S0173

Standing S0173

Reach

Coverage

FLIPSIDE MITRE reference S0173

Standing S0173

Reach

Coverage

FLIPSIDE detections S0173

FLIPSIDE detections S0173