tfMITRE ATT&CK sub-technique

External Proxy T1090.002

sub-technique of T1090 Proxy

Tactic: Command and Control
Platforms: ESXi, Linux, macOS, Network Devices, Windows
Version: 1.3
Created: 14 March 2020
Last modified: 12 May 2026

Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. [1] Adversaries use these types of proxies to manage command and control communications, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths to avoid suspicion.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 17%

Threat groups83rd percentile · 83% of ATT&CK techniques have this many threat groups attributed or fewer.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 24%

Tools & malware76th percentile · 76% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules54th pct

Detection rules54th percentile · 54% of ATT&CK techniques have this many detection rules written or fewer.

External Proxy MITRE reference T1090.002

Top 17%of all ATT&CK techniques for number of groups

11 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Tonto TeamG0131 ↗

Has routed their traffic through an external server in order to obfuscate their location.1

created 2021-05-051 referenceaka Earth Akhlut

GALLIUMG0093 ↗

Used a modified version of HTRAN to redirect connections between networks.1

created 2019-07-181 referenceaka Granite Typhoon

SilenceG0091 ↗

Has used ProxyBot, which allows the attacker to redirect traffic from the current node to the backconnect server via Sock4\Socks5.1

created 2019-05-241 referenceaka Whisper Spider

APT39G0087 ↗

Has used various tools to proxy C2 communications.1

created 2019-02-191 referenceaka ITG07

MuddyWaterG0069 ↗

Has controlled POWERSTATS from behind a proxy network to obfuscate the C2 location.1 MuddyWater has used a series of compromised websites that victims connected to randomly to relay information to command and control (C2).2 3 MuddyWater has also used go-socks5 variants to bypass firewalls and Network Address Translation (NAT), to communicate with a hardcoded C2 server, and to exfiltrate data.4

created 2018-04-184 referencesaka Earth Vetala

FIN5G0053 ↗

Maintains access to victim environments by using FLIPSIDE to create a proxy for a backup RDP tunnel.1

created 2018-01-161 reference

All 11 groups for this technique · 6 newest in this preview

Offense vs defense T1090.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 1

first rule: 2019 Q1 · 1 of 1 campaigns plotted

External Proxy detection strategy DET0325

MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

External Proxy Behavior via Outbound Relay to Intermediate Infrastructure

Enterprise

5 platforms

AN0922 · Windows

Unusual process (e.g., rundll32, mshta, wscript, or custom payloads) initiates network connection to external IPs/domains that proxy C2 traffic, often over uncommon ports or high entropy HTTP/S connections.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22
Network Traffic ContentDC0085	WinEventLog:Microsoft-Windows-Windows Defender/Operational	Unusual external domain access

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
DestinationASN	Adjust for known benign but high-risk infrastructure (e.g., hosting providers like DigitalOcean, OVH, etc.).
ParentProcess	Detect suspicious lineage—proxy tools launched from script interpreters or LOLBins.
EntropyThreshold	Tune based on expected randomness in outbound request payloads.

AN0923 · Linux

curl, wget, ncat, socat, or custom binaries initiate outbound traffic to Internet-based proxies (e.g., via VPS or CDN). Behavior may include reverse shell constructs or persistent outbound beacons.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
Network Traffic FlowDC0078	NSM:Flow	alert log
Network Traffic ContentDC0085	NSM:Flow	conn.log or http.log

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CommandLinePattern	Regex or command substring matches indicative of dynamic proxy setup.
ExternalIPList	Tunable list of IPs or ASNs related to known proxy/VPS abuse.
UserContext	Unexpected users running networking tools (e.g., www-data, apache).

AN0924 · macOS

AppleScript or terminal sessions launch tools (curl, nc, ssh) to external IPs not commonly accessed. Outbound connections are made by LaunchAgents/LaunchDaemons, often masquerading as system services.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	process logs
Network Traffic FlowDC0078	NSM:Flow	pf firewall logs
Network Connection CreationDC0082	macos:osquery	launchd or network_events

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
LaunchAgentPath	Detect persistence used to restart proxy after reboot.
ExternalPort	Often high or non-standard ports, configurable for outbound proxy detection.
ProcessReputation	Flag unsigned or anomalous binaries making external connections.

AN0925 · ESXi

ESXi shell or guest VM tools initiate external connections via scripted traffic forwarding to Internet-based proxies. Detected by firewall or shell audit logs showing outbound connection spikes from hypervisor or guest VM to remote proxy nodes.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	esxi:shell	None
Network Traffic FlowDC0078	esxi:vmkernel	None
Network Connection CreationDC0082	NSM:Flow	conn.log

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
VMOutboundPatterns	Detect when VMs communicate with Internet IPs not in workload profiles.
ProxyHostPattern	Regex for proxy-related tools/scripts executed on the host.
ConnectionDirectionality	Outbound only connections from ESXi to new IPs.

AN0926 · Network Devices

Changes to NAT/firewall policies enabling outbound port forwarding from internal IPs to Internet-based proxy endpoints. Log spikes in outbound flows to CDN, VPS, or anomalous ASNs with few return packets.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Firewall Rule ModificationDC0051	Firewall Audit Logs	Outbound NAT Rule Changes
Network Traffic FlowDC0078	NSM:Flow	Outbound flow records
Network Connection CreationDC0082	networkdevice:syslog	Dynamic route changes

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
FlowThreshold	Number of flows or bytes transferred per minute—flag surges to unrecognized ASNs.
DestinationIPCategory	Proxy destination categories: CDN, TOR exit node, anonymous hosting.
ConfigChangeUser	Track if unexpected user or automation changed NAT/forwarding rules.

External Proxy detections T1090.002

3 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

54th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs