T1572 Protocol Tunneling

Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. MITRE ATT&CK

1 program on CmdID 10 Sigma rules T1572 on attack.mitre.org

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules

ssh.exeits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first

highPotential RDP Tunneling Via PlinkFlorian Roth (Nextron Systems) · Windows

highPotential RDP Tunneling Via SSHNasreddine Bencherchali (Nextron Systems) · Windows

highPUA - 3Proxy ExecutionFlorian Roth (Nextron Systems) · Windows

highPUA - Ngrok ExecutionFlorian Roth (Nextron Systems) · Windows

highSuspicious Plink Port ForwardingFlorian Roth (Nextron Systems) · Windows

mediumCloudflared Tunnel Connections CleanupNasreddine Bencherchali (Nextron Systems) · Windows

mediumCloudflared Tunnel ExecutionJanantha Marasinghe, Nasreddine Bencherchali (Nextron Systems) · Windows

mediumPort Forwarding Activity Via SSH.EXENasreddine Bencherchali (Nextron Systems) · Windows

mediumPotentially Suspicious Usage Of QemuMuhammad Faisal (@faisalusuf), Hunter Juhan (@threatHNTR) · Windows

mediumTunneling Tool ExecutionDaniil Yugoslavskiy, oscd.community · Windows