attack.t1572

Cloudflared Tunnel Connections Cleanup

Aug 12, 2024 · attack.command-and-control attack.t1102 attack.t1090 attack.t1572 ·

Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.

Cloudflared Tunnel Execution

Aug 12, 2024 · attack.command-and-control attack.t1102 attack.t1090 attack.t1572 ·

Detects execution of the "cloudflared" tool to connect back to a tunnel. This was seen used by threat actors to maintain persistence and remote access to compromised networks.

Communication To LocaltoNet Tunneling Service Initiated

Aug 12, 2024 · attack.command-and-control attack.t1572 attack.t1090 attack.t1102 ·

Share on:

Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.

Communication To LocaltoNet Tunneling Service Initiated - Linux

Aug 12, 2024 · attack.command-and-control attack.t1572 attack.t1090 attack.t1102 ·

Share on:

Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.

Communication To Ngrok Tunneling Service - Linux

Aug 12, 2024 · attack.exfiltration attack.command-and-control attack.t1567 attack.t1568.002 attack.t1572 attack.t1090 attack.t1102 attack.s0508 ·

Share on:

Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors

Communication To Ngrok Tunneling Service Initiated

Aug 12, 2024 · attack.exfiltration attack.command-and-control attack.t1567 attack.t1568.002 attack.t1572 attack.t1090 attack.t1102 attack.s0508 ·

Share on:

Detects an executable initiating a network connection to "ngrok" tunneling domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.

Port Forwarding Activity Via SSH.EXE

Aug 12, 2024 · attack.command-and-control attack.lateral-movement attack.t1572 attack.t1021.001 attack.t1021.004 ·

Share on:

Detects port forwarding activity via SSH.exe

Potential RDP Tunneling Via Plink

Aug 12, 2024 · attack.command-and-control attack.t1572 ·

Share on:

Execution of plink to perform data exfiltration and tunneling

Potential RDP Tunneling Via SSH

Aug 12, 2024 · attack.command-and-control attack.t1572 ·

Share on:

Execution of ssh.exe to perform data exfiltration and tunneling through RDP

Potentially Suspicious Usage Of Qemu

Aug 12, 2024 · attack.command-and-control attack.t1090 attack.t1572 ·

Share on:

Detects potentially suspicious execution of the Qemu utility in a Windows environment. Threat actors have leveraged this utility and this technique for achieving network access as reported by Kaspersky.

PUA - 3Proxy Execution

Aug 12, 2024 · attack.command-and-control attack.t1572 ·

Share on:

Detects the use of 3proxy, a tiny free proxy server

PUA - Ngrok Execution

Aug 12, 2024 · attack.command-and-control attack.t1572 ·

Share on:

Detects the use of Ngrok, a utility used for port forwarding and tunneling, often used by threat actors to make local protected services publicly available. Involved domains are bin.equinox.io for download and *.ngrok.io for connections.