MirrorFaceG1054 ↗
Has used the GO Simple Tunnel (GOST) proxy tool.1
tfMITRE ATT&CK technique
Proxy T1090
- Tactic
- Command and Control
- Platforms
- ESXi, Linux, macOS, Network Devices, Windows
- Version
- 3.2
- Created
- 31 May 2017
- Last modified
- 12 May 2026
- Contributors
- Jon Sheedy; Heather Linn; Walker Johnson
Sub-techniques 447 rules across the family · 30 mapped directly to T1090 · 4 of 4 carry rules
Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. [1] Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
19
Threat groupsTop 9%
Threat groups91st percentile · 91% of ATT&CK techniques have this many threat groups attributed or fewer.10
CampaignsTop 3%
Campaigns97th percentile · 97% of ATT&CK techniques have this many campaigns recorded or fewer.47
Tools & malwareTop 8%
Tools & malware92nd percentile · 92% of ATT&CK techniques have this many tools implementing them or fewer.30
Detection rulesTop 9%
Detection rules91st percentile · 91% of ATT&CK techniques have this many detection rules written or fewer.Proxy MITRE reference T1090
Top 9%of all ATT&CK techniques for number of groups
19 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Contagious InterviewG1052 ↗
Has leveraged Astrill VPN for C2.1
Cinnamon TempestG1021 ↗
Has used a customized version of the Iox port-forwarding and proxy tool.1
MoustachedBouncerG1019 ↗
Has used a reverse proxy tool similar to the GitHub repository revsocks.1
Volt TyphoonG1017 ↗
Has used compromised devices and customized versions of open source tools such as FRP (Fast Reverse Proxy), Earthworm, and Impacket to proxy network traffic.123
Scattered SpiderG1015 ↗
Has used proxy networks to hamper detection and has installed legitimate proxy tools on VMware vCenter and adversary-controlled VMs.12
All 19 groups for this technique · 6 newest in this preview
10 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
SharePoint ToolShell ExploitationC0058 ↗
During SharePoint ToolShell Exploitation, threat actors used Fast Reverse Proxy to communicate with C2.12
2025 Poland Wiper AttacksC0063 ↗
During the 2025 Poland Wiper Attacks, the adversaries utilized the rsocx tool identified as r.exe and rsocx.exe to tunnel within the internal infrastructure using a Reverse SOCKS Proxy.12
RedPenguinC0056 ↗
During RedPenguin, UNC3886 used malware capable of establishing a SOCKS proxy connection to a specified IP and port.12
Operation MidnightEclipseC0048 ↗
During Operation MidnightEclipse, threat actors used the GO Simple Tunnel reverse proxy tool.1
RedDelta Modified PlugX Infection Chain OperationsC0047 ↗
Mustang Panda proxied communication through the Cloudflare CDN service during RedDelta Modified PlugX Infection Chain Operations.1
C0027C0027 ↗
During C0027, Scattered Spider installed the open-source rsocx reverse proxy tool on a targeted ESXi appliance.1
All 10 campaigns for this technique · 6 newest in this preview
47 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Kali365S9044 ↗
Has leveraged Cloudflare workers as reverse proxy infrastructure.123
HavocS1229 ↗
Has the ability to route HTTP/S communications through designated proxies.1
RansomHubS1212 ↗
Can use a proxy to connect to remote SFTP servers.1
SagerunexS1210 ↗
Uses several proxy configuration settings to ensure connectivity.1
GoBearS1197 ↗
Implements SOCKS5 proxy functionality.1
KapekaS1190 ↗
Can identify system proxy settings via WinHttpGetIEProxyConfigForCurrentUser() during initialization and utilize these settings for subsequent command and control operations.1
All 47 software entries for this technique · 6 newest in this preview
Offense vs defense T1090
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 10Sigma rules (cumulative) · 22Splunk ESCU (cumulative) · 8
first rule: 2019 Q1 · 10 of 10 campaigns plottedProxy detection strategy DET0445
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Proxy Infrastructure Setup and Traffic Bridging
5 platforms
AN1229 · Windows
Suspicious process spawning (e.g., rundll32, svchost, powershell, or netsh) followed by network connection creation to internal hosts or uncommon external endpoints on high or non-standard ports.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Network Traffic FlowDC0078 | NSM:Connections | Outbound Connection |
| Network Connection CreationDC0082 | WinEventLog:Sysmon | EventCode=3, 22 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ParentProcessName | Legitimate system processes that may rarely spawn network-capable child processes (e.g., rundll32, svchost). |
| DestinationPort | Watch for high-numbered ports or well-known proxy ports like 1080, 8080, 4444. |
| TimeWindow | Capture unusual spikes in outbound connections over a short period. |
AN1230 · Linux
User-space tools (e.g., socat, ncat, iptables, ssh) used in non-standard ways to establish reverse shells, port-forwarding, or inter-host connections. Often chained with uncommon outbound destinations or SSH tunnels.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve |
| Network Traffic FlowDC0078 | NSM:Flow | Connection Tracking |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CommandLinePattern | Shell piping into tools like socat, ncat, or openssl for tunnel creation. |
| OutboundPortRange | Flag connections made from internal systems to uncommon high ports externally. |
| ProcessUserContext | Capture low-privilege or unexpected users executing system-level network tools. |
AN1231 · macOS
AppleScript, LaunchAgents, or remote login services (ssh, networksetup) establishing proxy tunnels or dynamic port forwards to external IPs or alternate local hosts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | None |
| Network Traffic FlowDC0078 | NSM:Firewall | pf firewall logs |
| Network Connection CreationDC0082 | NSM:Flow | connection attempts |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TargetDomain | Identify suspicious domains often associated with CDN-routed or anonymized endpoints (e.g., Cloudflare, Fastly). |
| AppleScriptUsage | Alert when AppleScript or Automator tools are used for network tunneling tasks. |
| LaunchAgentSource | Monitor for LaunchAgents executing proxy tools or dynamic ports. |
AN1232 · ESXi
Direct use of nc, socat, or reverse tunnel scripts initiated by abnormal user contexts or unauthorized VIBs initiating connections from hypervisor to external systems.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Command ExecutionDC0064 | esxi:shell | None |
| Network Traffic FlowDC0078 | esxi:vmkernel | None |
| Network Connection CreationDC0082 | NSM:Flow | conn.log |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CLICommand | Custom proxy or port forwarding scripts executed from ESXi shell. |
| DestinationIP | Unusual outbound connections from ESXi host, particularly to internet. |
| UserContext | Root or elevated users initiating unexpected tunnels. |
AN1233 · Network Devices
Dynamic or static port forwarding rules added to route traffic through an internal host, or configuration changes to proxy firewall rules not aligned with baselined policy.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Firewall Rule ModificationDC0051 | NSM:Firewall | Policy Change / Rule Update |
| Command ExecutionDC0064 | networkdevice:cli | Interface commands |
| Network Traffic FlowDC0078 | NSM:Flow | Flow Creation (NetFlow/sFlow) |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| RuleType | Focus on new allow/permit rules with dynamic NAT or port forwarders. |
| ChangeUser | Flag any non-admins initiating proxy config changes. |
| FlowVolumeDelta | Detect sharp changes in bi-directional traffic patterns. |
Traffic to known anonymity networks and C2 infrastructure can be blocked through the use of network allow and block lists. It should be noted that this kind of blocking may be circumvented by other techniques like Domain Fronting.
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific C2 protocol used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools.
SSL/TLS InspectionM1020
If it is possible to inspect HTTPS traffic, the captures can be analyzed for connections that appear to be domain fronting.