Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet.
There are various means to encapsulate a protocol within another protocol. For example, adversaries may perform SSH tunneling (also known as SSH port forwarding), which involves forwarding arbitrary data over an encrypted SSH tunnel.[1][2]
Protocol Tunneling may also be abused by adversaries during Dynamic Resolution. Known as DNS over HTTPS (DoH), queries to resolve C2 infrastructure may be encapsulated within encrypted HTTPS packets.[3]
Top 12%of all ATT&CK techniques for number of groups
15 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Has installed protocol-tunneling tools on VMware vCenter and adversary-controlled VMs, including Teleport.sh, Chisel (configured to communicate with trycloudflare[.]com subdomains), MobaXterm, ngrok, Pinggy, and Teleport.12
During the C0032 campaign, TEMP.Veles used encrypted SSH-based PLINK tunnels to transfer tools and enable RDP connections throughout the environment.1
2014–2017
All 6 campaigns for this technique
21 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Has utilized a SOCKS proxy to tunnel access within the victim network and exfiltrate files from internal shares, code repositories, and other endpoints.1234567BRICKSTORM has also leveraged Yamux for combining multiple concurrent logical streams over a single a socket.256
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Protocol Tunneling accross OS platforms.
Enterprise
4 platforms
AN1483 · Windows
Processes such as plink.exe, ssh.exe, or netsh.exe establishing outbound network connections where traffic patterns show encapsulated protocols (e.g., RDP over SSH). Defender observations include anomalous process-to-network relationships, large asymmetric data flows, and port usage mismatches.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
AllowedTools
Whitelist legitimate tunneling tools (e.g., used by admins).
DataAsymmetryThreshold
Ratio of sent vs received bytes that indicates tunneling activity.
TimeWindow
Correlate process creation with network connection within N seconds.
AN1484 · Linux
sshd, socat, or custom binaries initiating port forwarding or encapsulating traffic (e.g., RDP, SMB) through SSH or HTTP. Defender sees abnormal connect/bind syscalls, encrypted traffic on ports typically used for non-encrypted services, and outlier traffic volume patterns.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
ForwardingFlags
Specific sshd config flags indicating port forwarding.
ProtocolBaseline
Define expected application protocols by port to catch tunneling mismatches.
AN1485 · macOS
launchd or user-invoked processes (ssh, socat) encapsulating traffic via SSH tunnels, VPN-style tooling, or DNS-over-HTTPS clients. Defender sees outbound TLS traffic with embedded DNS or RDP payloads.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
encrypted outbound traffic carrying unexpected application data
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
ExpectedDoHResolvers
Known legitimate DoH resolvers used in environment.
PayloadEntropyThreshold
Flag excessive randomness in payloads on standard ports.
AN1486 · ESXi
VMware daemons or user processes encapsulating traffic (e.g., guest VMs tunneling via hostd). Defender sees network services inside ESXi creating flows inconsistent with management plane traffic, such as SSH forwarding or DNS-over-HTTPS from management interfaces.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
Tests9Executorspowershell 4 · sh 4 · bash 1Need elevation1 of 9Have prerequisites6Have cleanup6Platformswindows, linux, macos
#
Test
Platform
Executor
Elevation
Prereqs
Cleanup
Ref
01
DNS over HTTPS Large Query Volume
windows
powershell
—
—
—
This test simulates an infected host sending a large volume of DoH queries to a command and control server.
The intent of this test is to trigger threshold based detection on the number of DoH queries either from a single source system or to a single targe domain.
A custom domain and sub-domain will need to be passed as input parameters for this test to work. Upon execution, DNS information about the domain will be displayed for each callout in a JSON format.
This test simulates an infected host beaconing via DoH queries to a command and control server at regular intervals over time.
This behaviour is typical of implants either in an idle state waiting for instructions or configured to use a low query volume over time to evade threshold based detection.
A custom domain and sub-domain will need to be passed as input parameters for this test to work. Upon execution, DNS information about the domain will be displayed for each callout in a JSON format.
Inputs
Name
Description
Type
Default Value
domain
Default domain to simulate against
string
127.0.0.1.xip.io
runtime
Time in minutes to run the simulation
integer
30
c2_jitter
Percentage of jitter to add to the C2 interval to create variance in the times between C2 requests
integer
20
subdomain
Subdomain prepended to the domain name
string
atomicredteam
doh_server
Default DoH resolver
string
https://8.8.8.8/resolve
query_type
DNS query type
string
TXT
c2_interval
Seconds between C2 requests to the command and control server
This test simulates an infected host returning data to a command and control server using long domain names.
The simulation involves sending DoH queries that gradually increase in length until reaching the maximum length. The intent is to test the effectiveness of detection of DoH queries for long domain names over a set threshold.
Upon execution, DNS information about the domain will be displayed for each callout in a JSON format.
Inputs
Name
Description
Type
Default Value
domain
Default domain to simulate against
string
127.0.0.1.xip.io
subdomain
Subdomain prepended to the domain name (should be 63 characters to test maximum length)
Dev Tunnels enables insiders as well as threat actors to expose local ports over the internet via Microsoft dev tunnels.
This atomic will generate a dev tunnel binding it to the local service running on the provided port. Can be used to expose local services, web applications and local files etc.
Reference:
- Microsoft Docs
- LOT Tunnels
Inputs
Name
Description
Type
Default Value
port
port number for tunnel
integer
8080
binary_path
path to download devtunnel
string
PathToAtomicsFolder/../ExternalPayloads/devtunnel
download_url
link to download devtunnel
string
https://aka.ms/TunnelsCliDownload/linux-x64
Attack Commandsrun with bash
#{binary_path} host -p #{port} &
Cleanup Commands
pkill -9 $(basename "#{binary_path}")
#{binary_path} user logout
rm #{binary_path}
#{binary_path} user show | grep -q "Not logged in" && exit 1 || exit 0
Get Prereq Commands
echo "Login to devtunnel using the following command: #{binary_path} user login"
GUID9f94a112-1ce2-464d-a63b-83c1f465f801
06
VSCode tunnels (Linux/macOS)
linux, macos
sh
—
2
Yes
Visual Studio Code Remote Tunnels can be used for exposing local development environment/services/files over the internet.
This atomic will generate a dev tunnel binding it to the local service running on the provided port.
Reference:
- Microsoft Docs
- LOT Tunnels
Inputs
Name
Description
Type
Default Value
payload_path
path to download code-cli
string
PathToAtomicsFolder/../ExternalPayloads
artifact_build
build to download - Allowed values (stable/insiders)
code tunnel user show | grep -q "not logged in" && exit 1 || exit 0
Get Prereq Commands
echo "Login to code tunnel using the following command: code tunnel user login"
GUIDb877943f-0377-44f4-8477-f79db7f07c4d
07
Cloudflare tunnels (Linux/macOS)
linux, macos
sh
—
1
Yes
Cloudflared can be used for exposing local development environment/services/files over the internet.
This atomic will generate a dev tunnel binding it to the local service running on the provided port.
Reference:
- Cloudflared Docs
- LOT Tunnels
Downloads and runs frpc (fast reverse proxy client), the victim-side component
of the frp framework. Adversaries deploy frpc on compromised hosts to establish
outbound tunnel connections to an attacker-controlled frps server, bypassing
inbound firewall rules and exposing internal services externally.
Downloads and runs gost (Go Simple Tunnel), a multi-protocol proxy and tunnel
tool used by adversaries to establish SOCKS5 proxies, protocol relays, and
encrypted tunnels on compromised hosts to facilitate C2 communication and
lateral movement while evading network controls.
Top 6%of all ATT&CK techniques for number of rules
Showing 1-37 of 37 rules
Drag headers to reorder | Drag edges to resize
Select
Title
Description
Category
Status
Event
OS
Product
MITRE ATT&CK
CVEs
Severity
Author
Created
Updated
ID
Refs
Splunk
This analytic detects creation of a Cisco IOS-XE tunnel interface with tunnel source, tunnel destination, and an IP address in the 10.10.12.0 network. (...)
Detects the use of Ngrok, a utility used for port forwarding and tunneling, often used by threat actors to make local protected services publicly available. (...)
The following analytic detects the execution of the socat utility with command-line arguments that configure a TCP or OpenSSL listener and bind an executable to incoming connections. (...)
The following analytic detects SSH connections presenting client banners that do not match known, common SSH client software by leveraging Zeek ssh logs. (...)
This analytic detects the use of Plink (including renamed versions like pvhost.exe) for protocol tunneling, which may be used for egress or lateral movement within an organization. (...)