T1090 Proxy
Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. MITRE ATT&CK
1 program on CmdID 11 Sigma rules T1090 on attack.mitre.org
Its sub-techniques
Programs for it
Sigma rules tagged with it
highRDP Port Forwarding Rule Added Via Netsh.EXEFlorian Roth (Nextron Systems), oscd.community · Windows
mediumCloudflared Tunnel ExecutionJanantha Marasinghe, Nasreddine Bencherchali (Nextron Systems) · Windows
mediumNew Port Forwarding Rule Added Via Netsh.EXEFlorian Roth (Nextron Systems), omkar72, oscd.community, Swachchhanda Shrawan Poudel · Windows
mediumPotentially Suspicious Usage Of QemuMuhammad Faisal (@faisalusuf), Hunter Juhan (@threatHNTR) · Windows
Command lines CmdID reads as it
Build an image passing build-time variables on the page for docker-buildx-build
docker buildx build --build-arg HTTP_PROXY=http://proxy.example.com --build-arg VERSION=1.0 .IdentifySet up IPv4 port forwarding (run in elevated console) on the page for netsh-interface-portproxy
netsh interface portproxy add v4tov4 listenaddress=192.168.0.1 listenport=8080 connectaddress=10.0.0.1 connectport=80IdentifyRemove IPv4 port forwarding (run in elevated console) on the page for netsh-interface-portproxy
netsh interface portproxy delete v4tov4 listenaddress=192.168.0.1 listenport=8080IdentifyAn example is here when CmdID’s reading of it names T1090: a Sigma rule it trips is tagged with it, or its abuse is documented as it.