[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1572":3},{"item":4,"lessons":18,"controls":68,"related":99},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1572","T1572","Protocol Tunneling",19,"MITRE","**What attackers do.** Attackers wrap their traffic inside another protocol, for example SSH, DNS or HTTPS tunnels, to get through network controls or reach systems that are not directly exposed. This serves the Command and Control tactic.\n\n**How to defend.** Restrict outbound protocols to what the business needs, force traffic through proxies and internal DNS resolvers, and block direct SSH and other tunnelling protocols to the internet. Inventory and control tunnelling tools on endpoints. Network detection tools can flag protocol anomalies inside allowed traffic.\n\n**Signs to look for.** Look for long-lived connections with steady data flow, unusually large or frequent DNS queries, SSH or tunnelling utilities on hosts that do not need them, and traffic to tunnelling service providers. A common gap is permitting outbound SSH or DNS to any resolver.","Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection\u002Fnetwork filtering and\u002For enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and\u002For provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet. \n\nThere are various means to encapsulate a protocol within another protocol. For example, adversaries may perform SSH tunneling (also known as SSH port forwarding), which involves forwarding arbitrary data over an encrypted SSH tunnel. \n\nProtocol Tunneling may also be abused by adversaries during Dynamic Resolution. Known as DNS over HTTPS (DoH), queries to resolve C2 infrastructure may be encapsulated within encrypted HTTPS packets.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1572\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"akira-ransomware-reconstructed-from-forensic-crumbs-after-edr-gap","Akira Ransomware Reconstructed from Forensic Crumbs After EDR Gap","2026-10-08T12:21:27.762+00:00",{"slug":25,"title":26,"published_at":27},"clingstun-linux-backdoor-exploits-dozens-of-flaws-via-stealthy-stun-protocol","ClingSTUN Linux Backdoor Exploits Dozens of Flaws via Stealthy STUN Protocol","2026-10-05T14:20:55.456+00:00",{"slug":29,"title":30,"published_at":31},"warlock-group-exploits-unpatched-sharepoint-to-hit-critical-infrastructure","Warlock Group Exploits Unpatched SharePoint to Hit Critical Infrastructure","2026-10-02T10:20:36.512+00:00",{"slug":33,"title":34,"published_at":35},"citrix-netscaler-zero-days-exploited-undetected-for-weeks","Citrix NetScaler Zero-Days Exploited Undetected for Weeks","2026-09-29T22:20:39.03+00:00",{"slug":37,"title":38,"published_at":39},"shinyhunters-exploits-unpatched-oracle-peoplesoft-to-breach-100-organizations","ShinyHunters Exploits Unpatched Oracle PeopleSoft to Breach 100+ Organizations","2026-09-28T19:22:43.303+00:00",{"slug":41,"title":42,"published_at":43},"webrtc-tunnels-exploit-whitelisted-video-platforms-to-bypass-network-controls","WebRTC Tunnels Exploit Whitelisted Video Platforms to Bypass Network Controls","2026-09-14T20:20:24.301+00:00",{"slug":45,"title":46,"published_at":47},"terminalfix-campaign-abuses-powershell-and-reverse-tunnels-for-deep-enterprise-infiltration","TerminalFix Campaign Abuses PowerShell and Reverse Tunnels for Deep Enterprise Infiltration","2026-08-31T22:21:13.202+00:00",{"slug":49,"title":50,"published_at":51},"terminalfix-malware-uses-fake-captchas-to-trick-users-into-opening-reverse-tunnels","TerminalFix Malware Uses Fake CAPTCHAs to Trick Users into Opening Reverse Tunnels","2026-08-31T20:20:31.988+00:00",{"slug":53,"title":54,"published_at":55},"fake-captcha-lures-users-into-running-malicious-commands","Fake CAPTCHA Lures Users Into Running Malicious Commands","2026-08-30T10:20:21.007+00:00",{"slug":57,"title":58,"published_at":59},"terminalfix-campaign-exploits-user-trust-to-deploy-persistent-reverse-tunnels","TerminalFix Campaign Exploits User Trust to Deploy Persistent Reverse Tunnels","2026-08-29T06:20:25.828+00:00",{"slug":61,"title":62,"published_at":63},"iranian-apt-nimbus-manticore-deploys-new-backdoor-and-ssh-tunneling-tools","Iranian APT Nimbus Manticore Deploys New Backdoor and SSH Tunneling Tools","2026-08-26T18:21:18.24+00:00",{"slug":65,"title":66,"published_at":67},"critical-vmware-vcenter-rce-exploited-for-persistent-reverse-ssh-access","Critical VMware vCenter RCE Exploited for Persistent Reverse SSH Access","2026-08-13T18:21:23.327+00:00",[69,74,79,84,89,94],{"slug":70,"name":71,"problem":72,"stories":73},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",16,{"slug":75,"name":76,"problem":77,"stories":78},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",9,{"slug":80,"name":81,"problem":82,"stories":83},"patch-management","Automated patch management","Known holes get closed in days, not months.",7,{"slug":85,"name":86,"problem":87,"stories":88},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",4,{"slug":90,"name":91,"problem":92,"stories":93},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",3,{"slug":95,"name":96,"problem":97,"stories":98},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",2,[100,106,112,117,121,126,130,135],{"family":101,"item":102,"code":103,"title":104,"together":105},"nist-800-53","sc-7","SC-7","Boundary Protection",15,{"family":107,"item":108,"code":109,"title":110,"together":111},"cis","13","Control 13","Network Monitoring and Defense",14,{"family":107,"item":113,"code":114,"title":115,"together":116},"12","Control 12","Network Infrastructure Management",10,{"family":107,"item":118,"code":119,"title":120,"together":116},"7","Control 7","Continuous Vulnerability Management",{"family":101,"item":122,"code":123,"title":124,"together":125},"si-2","SI-2","Flaw Remediation",8,{"family":107,"item":127,"code":128,"title":129,"together":83},"8","Control 8","Audit Log Management",{"family":101,"item":131,"code":132,"title":133,"together":134},"ac-17","AC-17","Remote Access",6,{"family":136,"item":137,"code":138,"title":138,"together":134},"itil","overview","ITIL"]