attack.t1572 | Detection.FYI

Communication To LocaltoNet Tunneling Service Initiated

May 20, 2025 · attack.command-and-control attack.t1572 attack.t1090 attack.t1102 ·
Share on:

Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.

Read More
Communication To LocaltoNet Tunneling Service Initiated - Linux

May 20, 2025 · attack.command-and-control attack.t1572 attack.t1090 attack.t1102 ·
Share on:

Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.

Read More
Potentially Suspicious Usage Of Qemu

Apr 16, 2025 · attack.command-and-control attack.t1090 attack.t1572 ·
Share on:

Detects potentially suspicious execution of the Qemu utility in a Windows environment. Threat actors have leveraged this utility and this technique for achieving network access as reported by Kaspersky.

Read More
SSH over port 443 with known Server and Client Strings

Mar 18, 2025 · attack.command-and-control attack.t1572 ·
Share on:

Will detect the presence of known SSH client and SSH server strings that have been used for SSH tunneling.

Read More
Port Forwarding Activity Via SSH.EXE

Jan 6, 2025 · attack.command-and-control attack.lateral-movement attack.t1572 attack.t1021.001 attack.t1021.004 ·
Share on:

Detects port forwarding activity via SSH.exe

Read More
Cloudflared Tunnel Connections Cleanup

Nov 1, 2024 · attack.command-and-control attack.t1102 attack.t1090 attack.t1572 ·
Share on:

Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.

Read More
Cloudflared Tunnel Execution

Nov 1, 2024 · attack.command-and-control attack.t1102 attack.t1090 attack.t1572 ·
Share on:

Detects execution of the "cloudflared" tool to connect back to a tunnel. This was seen used by threat actors to maintain persistence and remote access to compromised networks.

Read More
Communication To Ngrok Tunneling Service - Linux

Aug 12, 2024 · attack.exfiltration attack.command-and-control attack.t1567 attack.t1568.002 attack.t1572 attack.t1090 attack.t1102 attack.s0508 ·
Share on:

Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors

Read More
Communication To Ngrok Tunneling Service Initiated

Aug 12, 2024 · attack.exfiltration attack.command-and-control attack.t1567 attack.t1568.002 attack.t1572 attack.t1090 attack.t1102 attack.s0508 ·
Share on:

Detects an executable initiating a network connection to "ngrok" tunneling domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.

Read More
Potential RDP Tunneling Via Plink

Aug 12, 2024 · attack.command-and-control attack.t1572 ·
Share on:

Execution of plink to perform data exfiltration and tunneling

Read More
Potential RDP Tunneling Via SSH

Aug 12, 2024 · attack.command-and-control attack.t1572 ·
Share on:

Execution of ssh.exe to perform data exfiltration and tunneling through RDP

Read More
PUA - 3Proxy Execution

Aug 12, 2024 · attack.command-and-control attack.t1572 ·
Share on:

Detects the use of 3proxy, a tiny free proxy server

Read More
PUA - Ngrok Execution

Aug 12, 2024 · attack.command-and-control attack.t1572 ·
Share on:

Detects the use of Ngrok, a utility used for port forwarding and tunneling, often used by threat actors to make local protected services publicly available. Involved domains are bin.equinox.io for download and *.ngrok.io for connections.

Read More
RDP Over Reverse SSH Tunnel

Aug 12, 2024 · attack.command-and-control attack.t1572 attack.lateral-movement attack.t1021.001 car.2013-07-002 ·
Share on:

Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389

Read More
RDP to HTTP or HTTPS Target Ports

Aug 12, 2024 · attack.command-and-control attack.t1572 attack.lateral-movement attack.t1021.001 car.2013-07-002 ·
Share on:

Detects svchost hosting RDP termsvcs communicating to target systems on TCP port 80 or 443

Read More
Silence.EDA Detection

Aug 12, 2024 · attack.execution attack.t1059.001 attack.command-and-control attack.t1071.004 attack.t1572 attack.impact attack.t1529 attack.g0091 attack.s0363 ·
Share on:

Detects Silence EmpireDNSAgent as described in the Group-IP report

Read More
Suspicious Plink Port Forwarding

Aug 12, 2024 · attack.command-and-control attack.t1572 attack.lateral-movement attack.t1021.001 ·
Share on:

Detects suspicious Plink tunnel port forwarding to a local port

Read More