THREATNOIR
Subscribe
MITRE ATT&CK · T1572

Protocol Tunneling

MITRE · cited in 19 of our lessons

Explanation

What attackers do. Attackers wrap their traffic inside another protocol, for example SSH, DNS or HTTPS tunnels, to get through network controls or reach systems that are not directly exposed. This serves the Command and Control tactic.

How to defend. Restrict outbound protocols to what the business needs, force traffic through proxies and internal DNS resolvers, and block direct SSH and other tunnelling protocols to the internet. Inventory and control tunnelling tools on endpoints. Network detection tools can flag protocol anomalies inside allowed traffic.

Signs to look for. Look for long-lived connections with steady data flow, unusually large or frequent DNS queries, SSH or tunnelling utilities on hosts that do not need them, and traffic to tunnelling service providers. A common gap is permitting outbound SSH or DNS to any resolver.

Open the technique on MITRE ATT&CK
The official text
Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet. There are various means to encapsulate a protocol within another protocol. For example, adversaries may perform SSH tunneling (also known as SSH port forwarding), which involves forwarding arbitrary data over an encrypted SSH tunnel. Protocol Tunneling may also be abused by adversaries during Dynamic Resolution. Known as DNS over HTTPS (DoH), queries to resolve C2 infrastructure may be encapsulated within encrypted HTTPS packets.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered: the latest 12 of 19.