attack.t1090

Potentially Suspicious Usage Of Qemu

Apr 16, 2025 · attack.command-and-control attack.t1090 attack.t1572 ·

Detects potentially suspicious execution of the Qemu utility in a Windows environment. Threat actors have leveraged this utility and this technique for achieving network access as reported by Kaspersky.

Kalambur Backdoor Curl TOR SOCKS Proxy Execution

Feb 17, 2025 · attack.command-and-control attack.t1090 attack.t1573 attack.t1071.001 attack.t1059.001 attack.s0183 detection.emerging-threats ·

Share on:

Detects the execution of the "curl.exe" command, referencing "SOCKS" and ".onion" domains, which could be indicative of Kalambur backdoor activity.

OpenCanary - HTTPPROXY Login Attempt

Feb 3, 2025 · attack.initial-access attack.defense-evasion attack.t1090 ·

Share on:

Detects instances where an HTTPPROXY service on an OpenCanary node has had an attempt to proxy another page.

PUA - Fast Reverse Proxy (FRP) Execution

Nov 25, 2024 · attack.command-and-control attack.t1090 ·

Share on:

Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or firewall to the Internet.

PUA - NPS Tunneling Tool Execution

Nov 25, 2024 · attack.command-and-control attack.t1090 ·

Share on:

Detects the use of NPS, a port forwarding and intranet penetration proxy server

PUA- IOX Tunneling Tool Execution

Nov 25, 2024 · attack.command-and-control attack.t1090 ·

Share on:

Detects the use of IOX - a tool for port forwarding and intranet proxy purposes

Cloudflared Tunnel Connections Cleanup

Nov 1, 2024 · attack.command-and-control attack.t1102 attack.t1090 attack.t1572 ·

Share on:

Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.

Cloudflared Tunnel Execution

Nov 1, 2024 · attack.command-and-control attack.t1102 attack.t1090 attack.t1572 ·

Share on:

Detects execution of the "cloudflared" tool to connect back to a tunnel. This was seen used by threat actors to maintain persistence and remote access to compromised networks.

Communication To LocaltoNet Tunneling Service Initiated

Aug 12, 2024 · attack.command-and-control attack.t1572 attack.t1090 attack.t1102 ·

Share on:

Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.

Communication To LocaltoNet Tunneling Service Initiated - Linux

Aug 12, 2024 · attack.command-and-control attack.t1572 attack.t1090 attack.t1102 ·

Share on:

Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.

Communication To Ngrok Tunneling Service - Linux

Aug 12, 2024 · attack.exfiltration attack.command-and-control attack.t1567 attack.t1568.002 attack.t1572 attack.t1090 attack.t1102 attack.s0508 ·

Share on:

Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors

Communication To Ngrok Tunneling Service Initiated

Aug 12, 2024 · attack.exfiltration attack.command-and-control attack.t1567 attack.t1568.002 attack.t1572 attack.t1090 attack.t1102 attack.s0508 ·

Share on:

Detects an executable initiating a network connection to "ngrok" tunneling domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.

Connection Proxy

Aug 12, 2024 · attack.defense-evasion attack.t1090 ·

Share on:

Detects setting proxy configuration

HackTool - Htran/NATBypass Execution

Aug 12, 2024 · attack.command-and-control attack.t1090 attack.s0040 ·

Share on:

Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass)

Malicious IP Address Sign-In Failure Rate

Aug 12, 2024 · attack.t1090 attack.command-and-control ·

Share on:

Indicates sign-in from a malicious IP address based on high failure rates.

Malicious IP Address Sign-In Suspicious

Aug 12, 2024 · attack.t1090 attack.command-and-control ·

Share on:

Indicates sign-in from a malicious IP address known to be malicious at time of sign-in.

New Port Forwarding Rule Added Via Netsh.EXE

Aug 12, 2024 · attack.lateral-movement attack.defense-evasion attack.command-and-control attack.t1090 ·

Share on:

Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule

New PortProxy Registry Entry Added

Aug 12, 2024 · attack.lateral-movement attack.defense-evasion attack.command-and-control attack.t1090 ·

Share on:

Detects the modification of the PortProxy registry key which is used for port forwarding.

Ngrok Usage with Remote Desktop Service

Aug 12, 2024 · attack.command-and-control attack.t1090 ·

Share on:

Detects cases in which ngrok, a reverse proxy tool, forwards events to the local RDP port, which could be a sign of malicious behaviour

RDP Port Forwarding Rule Added Via Netsh.EXE

Aug 12, 2024 · attack.lateral-movement attack.defense-evasion attack.command-and-control attack.t1090 ·

Share on:

Detects the execution of netsh to configure a port forwarding of port 3389 (RDP) rule

Sign-In From Malware Infected IP

Aug 12, 2024 · attack.t1090 attack.command-and-control ·

Share on:

Indicates sign-ins from IP addresses infected with malware that is known to actively communicate with a bot server.

Suspicious TCP Tunnel Via PowerShell Script

Aug 12, 2024 · attack.command-and-control attack.t1090 ·

Share on:

Detects powershell scripts that creates sockets/listeners which could be indicative of tunneling activity