tfMITRE ATT&CK sub-technique

Internal Proxy T1090.001

sub-technique of T1090 Proxy

Tactic: Command and Control
Platforms: ESXi, Linux, macOS, Network Devices, Windows
Version: 1.2
Created: 14 March 2020
Last modified: 12 May 2026

Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. [1] Adversaries use internal proxies to manage command and control communications inside a compromised environment, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between infected systems to avoid suspicion. Internal proxy connections may use common peer-to-peer (p2p) networking protocols, such as SMB, to better blend in with the environment.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 20%

Threat groups80th percentile · 80% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 12%

Campaigns88th percentile · 88% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 15%

Tools & malware85th percentile · 85% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules71st pct

Detection rules71st percentile · 71% of ATT&CK techniques have this many detection rules written or fewer.

Internal Proxy MITRE reference T1090.001

Top 20%of all ATT&CK techniques for number of groups

9 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Velvet AntG1047 ↗

Has tunneled traffic from victims through an internal, compromised host to proxy communications to command and control nodes.1

created 2025-03-141 reference

Volt TyphoonG1017 ↗

Has used the built-in netsh port proxy command to create proxies on compromised systems to facilitate access.1 2

created 2023-07-272 referencesaka BRONZE SILHOUETTE

FIN13G1016 ↗

Has utilized a proxy tool to communicate between compromised assets.1

created 2023-07-271 referenceaka Elephant Beetle

HigaisaG0126 ↗

Discovered system proxy settings and used them if available.1

created 2021-03-051 reference

APT39G0087 ↗

Used custom tools to create SOCK5 and custom protocol proxies between infected hosts.1 2

created 2019-02-192 referencesaka ITG07

StriderG0041 ↗

Has used local servers with both local network and Internet access to act as internal proxy nodes to exfiltrate data from other parts of the network without direct Internet access.1

created 2017-05-311 referenceaka ProjectSauron

All 9 groups for this technique · 6 newest in this preview

3 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

APT28 Nearest Neighbor CampaignC0051 ↗

During APT28 Nearest Neighbor Campaign, APT28 used the built-in netsh portproxy command to create internal proxies on compromised systems.1

2022–2024

SolarWinds CompromiseC0024 ↗

During the SolarWinds Compromise, APT29 used SSH port forwarding capabilities on public-facing systems, and configured at least one instance of Cobalt Strike to use a network pipe over SMB.1 2

2019–2021

Operation WocaoC0014 ↗

During Operation Wocao, threat actors proxied traffic through multiple infected systems.1

2017–2019

All 3 campaigns for this technique

Offense vs defense T1090.001

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 3Sigma rules (cumulative) · 6Splunk ESCU (cumulative) · 2

first rule: 2019 Q1 · 3 of 3 campaigns plotted

Internal Proxy detection strategy DET0075

MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Internal Proxy Behavior via Lateral Host-to-Host C2 Relay

Enterprise

5 platforms

AN0204 · Windows

Anomalous process (e.g., rundll32, svchost, cmd) initiates connections to internal peer hosts not seen in typical communication baselines, used to proxy or forward traffic internally, often using SMB, RPC, or high ports.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Network Traffic FlowDC0078	Windows Firewall Log	SMB over high port
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
InternalConnectionPattern	Tune based on known host-to-host communications that are rare (e.g., workstation-to-workstation).
DestinationPort	Focus on unusual internal traffic on ports like 1080, 8080, 4444, or SMB over non-standard ports.
TimeWindow	Correlate unusual traffic bursts with new process execution.

AN0205 · Linux

socat, ssh, iptables, or ncat invoked from user space or cron jobs to create port forwarding, reverse shells, or inter-host tunnels between compromised Linux systems. Behavior is typically paired with socket activity and high entropy traffic.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
Network Traffic FlowDC0078	NSM:Connections	Internal connection logging
Network Traffic ContentDC0085	NSM:Flow	conn.log

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UserContext	Alert on unexpected users executing inter-host relay tools (e.g., `www-data`, `backup`).
PortRange	Adjust to watch for commonly misused internal TCP/UDP ports.
ProcessPattern	Shell pipelines or wrapped invocations like `bash -c 'socat ...'`

AN0206 · macOS

Execution of AppleScript or Automator services launching ssh -L, socat, or launchctl items that dynamically reroute traffic from one Mac endpoint to another. LaunchAgents used to establish permanent internal tunnels.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	None
Service CreationDC0060	macos:osquery	Process Events and Launch Daemons
Network Traffic FlowDC0078	NSM:Flow	pf firewall logs

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
LaunchAgentPath	Directory where proxying LaunchDaemons may be dropped, e.g., `/Library/LaunchDaemons/`.
PortBindings	Dynamic port forwards often use ephemeral or non-standard service ports.
AppleScriptUsage	May trigger on less common scripting interfaces for traffic redirection.

AN0207 · ESXi

ESXi shell execution of tools/scripts (nc, socat, perl) relaying network traffic to other internal hosts, especially when initiated by unauthorized users or VMs.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	esxi:shell	/var/log/shell.log
Network Traffic FlowDC0078	esxi:vmkernel	/var/log/vmkernel.log
Network Connection CreationDC0082	NSM:Flow	conn.log

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CLICommandPattern	Watch for chained shell commands building local-to-local connections.
VMInitiator	Correlate to which VM initiated the traffic tunnel; unexpected VM behavior may be suspicious.
ConnectionDirectionality	Unusual east-west communication patterns among VMs.

AN0208 · Network Devices

Configuration of internal NAT or proxy rules that redirect traffic between client segments internally (e.g., site-to-site port forwarding). Often used to relay internal beaconing or move traffic laterally through trust zones.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Firewall Rule ModificationDC0051	Firewall Audit Logs	Config Change
Command ExecutionDC0064	networkdevice:cli	Policy Update
Network Traffic FlowDC0078	NSM:Flow	Inter-segment traffic

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ProxyTarget	Internal subnets or endpoint roles allowed for port forwarding.
ConfigChangeUser	Detect changes made outside scheduled or authorized windows.
FlowThreshold	Volume of data relayed through proxy exceeds historical norms.

Tests3Executorssh 2 · PowerShell 1Need elevation1 of 3Have prerequisites1Have cleanup3Platformslinux, macos, windows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Connection Proxy

linux, macos

—

Yes

Enable traffic redirection. Note that this test may conflict with pre-existing system configuration.

Input arguments

Name	Type	Default	Description
test_url	string	http://google.com	URL to test proxy connection
run_squid	string	false	If set to true, the test will install and configure a proxy server on the endpoint. Note that this test may conflict with pre-existing system configuration.
proxy_port	integer	3128	Proxy server port
proxy_scheme	string	http	Protocol to proxy (http or https)
proxy_server	url	127.0.0.1	Proxy server URL

Attack command

export #{proxy_scheme}_proxy=#{proxy_server}:#{proxy_port}
curl #{test_url}

Cleanup command

unset #{proxy_scheme}_proxy
[ "#{run_squid}" == "true" ] && (kill -9 $(ps aux | grep "squid -N" | grep -v "grep" | awk '{print $2}'))

Prerequisite

Squid must be installed and running

Check

if ([ "#{run_squid}" = "false" ] || ([ -x "$(command -v squid --version)" ] && (ps aux | grep "squid -N" | grep -v "grep"))); then exit 0; else exit 1; fi;

Satisfy

[ "#{run_squid}" = "true" ] && ([ -x "$(command -v squid --version)" ] || sudo DEBIAN_FRONTEND=noninteractive apt-get -y install squid curl || sudo yum install -y squid curl || sudo dnf install -y squid curl || brew install curl squid) && (squid -N -d 1 &) && exit 0
echo "Value #{run_squid} for variable "run_squid" is not valid" && exit 1

GUID8b2f84e3-695e-45fd-82a5-58832490601c

Connection Proxy for macOS UI

macos

—

Yes

Enable traffic redirection on macOS UI (not terminal). The test will modify and enable the "Web Proxy" and "Secure Web Proxy" settings in System Preferences => Network => Advanced => Proxies for the specified network interface. Note that this test may conflict with pre-existing system configuration.

Input arguments

Name	Type	Default	Description
interface	string	Wi-Fi	Protocol to proxy (http or https)
proxy_port	integer	8080	Proxy server port
proxy_server	url	127.0.0.1	Proxy server URL (host)

Attack command

networksetup -setwebproxy #{interface} #{proxy_server} #{proxy_port}
networksetup -setsecurewebproxy #{interface} #{proxy_server} #{proxy_port}

Cleanup command

networksetup -setwebproxystate #{interface} off
networksetup -setsecurewebproxystate #{interface} off

GUIDdd1b8725-c24f-4856-8348-4971f1448039

portproxy reg key

windows

PowerShell

Required

—

Yes

Adds a registry key to set up a proxy on the endpoint at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4 Upon execution there will be a new proxy entry in netsh netsh interface portproxy show all

Input arguments

Name	Type	Default	Description
listenport	string	1337	Specifies the IPv4 port, by port number or service name, on which to listen.
connectport	string	1337	Specifies the IPv4 port, by port number or service name, to which to connect. If connectport is not specified, the default is the value of listenport on the local computer.
connectaddress	string	127.0.0.1	Specifies the IPv4 address to which to connect. Acceptable values are IP address, computer NetBIOS name, or computer DNS name. If an address is not specified, the default is the local computer.

Attack command

netsh interface portproxy add v4tov4 listenport=#{listenport} connectport=#{connectport} connectaddress=#{connectaddress}

Cleanup command

netsh interface portproxy delete v4tov4 listenport=#{listenport} -ErrorAction Ignore | Out-Null

GUID3627f737-7131-4d1f-bef4-7956c0586860

Tests from Atomic Red Team (MIT licence) · technique definition

Internal Proxy detections T1090.001

8 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

71st pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs