MITRE ATT&CK · T1090

Proxy

MITRE · cited in 19 of our lessons

What attackers do. Attackers route traffic through intermediary systems, such as compromised hosts, rented servers, residential proxy networks or anonymising services, to hide where it really comes from or to reach systems that are not directly reachable. This serves the Command and Control tactic.

How to defend. Restrict outbound connections to known proxies and block anonymising networks where business allows. Inside the network, monitor for hosts acting as relays between segments. On the identity side, use reputation data on residential proxies and anonymisers when evaluating logins.

Signs to look for. Look for internal hosts listening on unusual ports and forwarding traffic, connections to known proxy or anonymisation infrastructure, and logins whose source changes rapidly between unrelated networks. A common gap is that residential proxies make malicious logins appear to come from ordinary home connections.

Open the technique on MITRE ATT&CK

The official text

Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic. Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.

Lessons that cite it

Real incidents where this item mattered: the latest 12 of 19.

Explanation

Lessons that cite it