attack.t1090

Detects execution of the "cloudflared" tool to connect back to a tunnel. This was seen used by threat actors to maintain persistence and remote access to compromised networks.

Communication To LocaltoNet Tunneling Service Initiated

Aug 12, 2024 · attack.command-and-control attack.t1572 attack.t1090 attack.t1102 ·

Share on:

Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.

Communication To LocaltoNet Tunneling Service Initiated - Linux

Aug 12, 2024 · attack.command-and-control attack.t1572 attack.t1090 attack.t1102 ·

Share on:

Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.

Communication To Ngrok Tunneling Service - Linux

Aug 12, 2024 · attack.exfiltration attack.command-and-control attack.t1567 attack.t1568.002 attack.t1572 attack.t1090 attack.t1102 attack.s0508 ·

Share on:

Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors

Communication To Ngrok Tunneling Service Initiated

Aug 12, 2024 · attack.exfiltration attack.command-and-control attack.t1567 attack.t1568.002 attack.t1572 attack.t1090 attack.t1102 attack.s0508 ·

Share on:

Detects an executable initiating a network connection to "ngrok" tunneling domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.

Connection Proxy

Aug 12, 2024 · attack.defense-evasion attack.t1090 ·

Share on:

Detects setting proxy configuration

HackTool - Htran/NATBypass Execution

Aug 12, 2024 · attack.command-and-control attack.t1090 attack.s0040 ·

Share on:

Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass)

Malicious IP Address Sign-In Failure Rate

Aug 12, 2024 · attack.t1090 attack.command-and-control ·

Share on:

Indicates sign-in from a malicious IP address based on high failure rates.

Malicious IP Address Sign-In Suspicious

Aug 12, 2024 · attack.t1090 attack.command-and-control ·

Share on:

Indicates sign-in from a malicious IP address known to be malicious at time of sign-in.

New Port Forwarding Rule Added Via Netsh.EXE

Aug 12, 2024 · attack.lateral-movement attack.defense-evasion attack.command-and-control attack.t1090 ·

Share on:

Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule

New PortProxy Registry Entry Added

Aug 12, 2024 · attack.lateral-movement attack.defense-evasion attack.command-and-control attack.t1090 ·

Share on:

Detects the modification of the PortProxy registry key which is used for port forwarding.

Ngrok Usage with Remote Desktop Service

Aug 12, 2024 · attack.command-and-control attack.t1090 ·

Share on:

Detects cases in which ngrok, a reverse proxy tool, forwards events to the local RDP port, which could be a sign of malicious behaviour

OpenCanary - HTTPPROXY Login Attempt

Aug 12, 2024 · attack.initial-access attack.defense-evasion attack.t1090 ·

Share on:

Detects instances where an HTTPPROXY service on an OpenCanary node has had an attempt to proxy another page.

Potentially Suspicious Usage Of Qemu

Aug 12, 2024 · attack.command-and-control attack.t1090 attack.t1572 ·

Share on:

Detects potentially suspicious execution of the Qemu utility in a Windows environment. Threat actors have leveraged this utility and this technique for achieving network access as reported by Kaspersky.

RDP Port Forwarding Rule Added Via Netsh.EXE

Aug 12, 2024 · attack.lateral-movement attack.defense-evasion attack.command-and-control attack.t1090 ·

Share on:

Detects the execution of netsh to configure a port forwarding of port 3389 (RDP) rule

Sign-In From Malware Infected IP

Aug 12, 2024 · attack.t1090 attack.command-and-control ·

Share on:

Indicates sign-ins from IP addresses infected with malware that is known to actively communicate with a bot server.

Suspicious TCP Tunnel Via PowerShell Script

Aug 12, 2024 · attack.command-and-control attack.t1090 ·

Share on:

Detects powershell scripts that creates sockets/listeners which could be indicative of tunneling activity