tfMITRE ATT&CK sub-technique

Multi-hop Proxy T1090.003

sub-technique of T1090 Proxy

Tactic: Command and Control
Platforms: ESXi, Linux, macOS, Network Devices, Windows
Version: 2.4
Created: 14 March 2020
Last modified: 12 May 2026
Contributor: Eduardo Chavarro Ovalle

Adversaries may chain together multiple proxies to disguise the source of malicious traffic. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 15%

Threat groups85th percentile · 85% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 5%

Campaigns95th percentile · 95% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 15%

Tools & malware85th percentile · 85% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules67th pct

Detection rules67th percentile · 67% of ATT&CK techniques have this many detection rules written or fewer.

Multi-hop Proxy MITRE reference T1090.003

Top 15%of all ATT&CK techniques for number of groups

12 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

ShinyHuntersG1057 ↗

Has used Tor to host their DLS.1

created 2026-07-291 referenceaka UNC6240

Medusa GroupG1051 ↗

Has used TOR nodes for communications.1 2 3

created 2025-10-153 references

Volt TyphoonG1017 ↗

Has used multi-hop proxies for command-and-control infrastructure.1

created 2023-07-271 referenceaka BRONZE SILHOUETTE

Ember BearG1003 ↗

Has configured multi-hop proxies via ProxyChains within victim environments.1

created 2022-06-091 referenceaka UNC2589

ZIRCONIUMG0128 ↗

Has utilized an ORB (operational relay box) network – consisting compromised devices such as small office and home office (SOHO) routers, IoT devices, and leased virtual private servers (VPS) – to proxy traffic.1

created 2021-03-241 referenceaka APT31

InceptionG0100 ↗

Used chains of compromised routers to proxy C2 communications between them and cloud service providers.1

created 2020-05-081 referenceaka Inception Framework

All 12 groups for this technique · 6 newest in this preview

Offense vs defense T1090.003

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 8Sigma rules (cumulative) · 3Splunk ESCU (cumulative) · 3

first rule: 2019 Q4 · 8 of 8 campaigns plotted

Multi-hop Proxy detection strategy DET0359

MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Multi-hop Proxy Behavior via Relay Node Chaining, Onion Routing, and Network Tunneling

Enterprise

5 platforms

AN1020 · Windows

Suspicious processes (e.g., Tor clients, relays, unknown binaries) launch with sustained encrypted outbound traffic to known anonymity infrastructure (e.g., Tor, I2P), and may relay to additional internal systems via reverse proxying, ICMP tunneling, or socket forwarding.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Network Traffic FlowDC0078	dns:query	Outbound resolution to hidden service domains (e.g., `.onion`)
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
DomainCategory	Can be tuned to `.onion`, I2P, or suspicious CDN domains.
ProcessParent	Detect known-good vs. abnormal launching binaries (e.g., mshta spawning Tor).
ConnectionDuration	Threshold for persistent connections over known relay ports (e.g., 9050).

AN1021 · Linux

Tools such as tor, nglite, proxychains, chisel, or custom daemons repeatedly initiate outbound sessions to multiple nodes before final destination. This behavior is abnormal for Linux services outside of VPN, monitoring, or CDN relay contexts.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve for proxy tools
Network Traffic FlowDC0078	NSM:Flow	conn.log + ssl.log with Tor fingerprinting
Network Traffic ContentDC0085	Netfilter/iptables	Forwarded packets log

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ExecutablePath	Match known proxy tools, tuned for environment.
RelayCount	Detect outbound chaining behavior through >2 IPs in short succession.
ProtocolType	Allow filtering by ICMP, TCP/443, UDP for obfuscation channels.

AN1022 · macOS

LaunchAgents or LaunchDaemons initiate persistent Tor or relay processes that make encrypted outbound connections. May be paired with sandbox bypasses or unsigned executables communicating over SOCKS proxies.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	process, socket, and DNS logs
Network Traffic FlowDC0078	macos:unifiedlog	forwarded encrypted traffic
Network Connection CreationDC0082	macos:osquery	process_events + launchd

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
LaunchdLabel	Regex for masking patterns in LaunchAgents with proxy behavior.
UnsignedBinary	Allow for exceptions for known unsigned binaries.
SOCKSPortUsage	Monitor local 9050/9150 activity and rerouted system traffic.

AN1023 · ESXi

Outbound encrypted traffic initiated from hypervisor shell or via VM backdoor mechanisms to relays in VPS infrastructure, especially if traversing multiple nodes before reaching Internet destination. Packet captures or firewall logs show non-VM communication paths.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Traffic FlowDC0078	esxi:vmkernel	/var/log/vmkernel.log
Network Connection CreationDC0082	esxi:esxupdate	/var/log/esxupdate.log or /var/log/vmksummary.log
Network Traffic ContentDC0085	NSM:Flow	Relay patterns across IP hops

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
HopCount	Threshold on number of IPs contacted in sequence without DNS resolution.
ShellAccess	Flag if relay communication initiated by ESXi shell or unknown VM agent.
VPSIPRange	Filter for known Tor/VPS egress networks.

AN1024 · Network Devices

Encrypted traffic or ICMP tunneling from border routers to internal routers or unknown external IPs. Forwarded traffic shows consistent hop-to-hop relaying without matching configured VPN or expected network topology.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Firmware ModificationDC0004	networkdevice:syslog	Custom firmware or routing changes
Network Traffic FlowDC0078	NSM:Flow	Relayed session pathing (multi-hop)
Network Traffic ContentDC0085	NSM:Firewall	Outbound encrypted traffic

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
VPNConfigWhitelist	Define allowed internal router communication paths.
ICMPPayloadEntropy	High entropy ICMP payloads may indicate tunneling activity.
RelayChainSignature	Track known multi-hop pattern signatures or port hopping techniques.

Tests4ExecutorsPowerShell 2 · sh 2Need elevation1 of 4Have prerequisites4Have cleanup3Platformswindows, linux, macos

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Psiphon

windows

PowerShell

—

Yes

Psiphon 3 is a circumvention tool from Psiphon Inc. that utilizes VPN, SSH and HTTP Proxy technology to provide you with uncensored access to Internet. This process will launch Psiphon 3 and establish a connection. Shortly after it will be shut down via process kill commands. More information can be found about Psiphon using the following urls http://s3.amazonaws.com/0ubz-2q11-gi9y/en.html https://psiphon.ca/faq.html

Attack command

& "PathToAtomicsFolder\T1090.003\src\Psiphon.bat"

Cleanup command

$Proxy = Get-Content $env:Temp\proxy-backup.txt -ErrorAction Ignore
if($null -ne $Proxy) 
{Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings' -Name "ProxyServer" -Value $Proxy}

Prerequisite

The proxy settings backup file must exist on disk at $env:Temp\proxy-backup.txt

Check

if (Test-Path $env:Temp\proxy-backup.txt) {exit 0} else {exit 1}

Satisfy

if(-not (test-path $env:Temp\proxy-backup.txt)){
$Proxy = (Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings' -Name "ProxyServer" -ErrorAction Ignore).ProxyServer
Set-Content $env:Temp\proxy-backup.txt $Proxy}

Prerequisite

The Psiphon executable must exist in the Downloads folder

Check

if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\psiphon3.exe") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction ignore -Force | Out-Null
Invoke-WebRequest "https://s3.amazonaws.com/0ubz-2q11-gi9y/psiphon3.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\psiphon3.exe"

Prerequisite

Batch file containing commands to run must be in src directory

Check

if (Test-Path "PathToAtomicsFolder\T1090.003\src\Psiphon.bat") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\T1090.003\src\" -ErrorAction ignore -Force | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1090.003/src/Psiphon.bat" -OutFile "PathToAtomicsFolder\T1090.003\src\Psiphon.bat"

GUID07dfe005-47c7-4191-86aa-d72fa01ae1ef

Tor Proxy Usage - Windows

windows

PowerShell

—

This test is designed to launch the tor proxy service, which is what is utilized in the background by the Tor Browser and other applications with add-ons in order to provide onion routing functionality. Upon successful execution, the tor proxy will be launched, run for 60 seconds, and then exit.

Input arguments

Name	Type	Default	Description
TorExe	string	PathToAtomicsFolder\..\ExternalPayloads\tor\Tor\tor.exe	Location of tor.exe file.

Attack command

invoke-expression 'cmd /c start powershell -Command {cmd /c "#{TorExe}"}'
sleep -s 60
stop-process -name "tor" | out-null

Prerequisite

tor.exe must be installed on the machine

Check

if (Test-Path "#{TorExe}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://archive.torproject.org/tor-package-archive/torbrowser/11.0.6/tor-win32-0.4.6.9.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\tor.zip"
expand-archive -LiteralPath "PathToAtomicsFolder\..\ExternalPayloads\tor.zip" -DestinationPath "PathToAtomicsFolder\..\ExternalPayloads\tor"

GUID1037e501-8918-4334-85a3-97d2e756078a

Tor Proxy Usage - Debian/Ubuntu/FreeBSD

linux

Required

Yes

Tor Proxy Usage - MacOS

macos

—

Yes

Tests from Atomic Red Team (MIT licence) · technique definition

Multi-hop Proxy detections T1090.003

6 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

67th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs