Techniques › T1090 › T1090.001

T1090.001 Internal Proxy

command and control — ESXi, Linux, macOS, Network Devices, Windows · attack.mitre.org · JSON

KEV CVEs mapped to this technique · CTID Mappings Explorer

Detection strategy · ATT&CK Enterprise v19.2

• DET0075 Internal Proxy Behavior via Lateral Host-to-Host C2 Relay v1.0
  AN0204 Windows

  Anomalous process (e.g., rundll32, svchost, cmd) initiates connections to internal peer hosts not seen in typical communication baselines, used to proxy or forward traffic internally, often using SMB, RPC, or high ports.

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  Windows Firewall Log SMB over high port → DC0078 Network Traffic Flow

  Tunable: InternalConnectionPattern DestinationPort TimeWindow
  AN0205 Linux

  socat, ssh, iptables, or ncat invoked from user space or cron jobs to create port forwarding, reverse shells, or inter-host tunnels between compromised Linux systems. Behavior is typically paired with socket activity and high entropy traffic.

  auditd:SYSCALL execve → DC0032 Process Creation

  NSM:Connections Internal connection logging → DC0078 Network Traffic Flow

  NSM:Flow conn.log → DC0085 Network Traffic Content

  Tunable: UserContext PortRange ProcessPattern
  AN0206 macOS

  Execution of AppleScript or Automator services launching ssh -L, socat, or launchctl items that dynamically reroute traffic from one Mac endpoint to another. LaunchAgents used to establish permanent internal tunnels.

  macos:unifiedlog None → DC0032 Process Creation

  NSM:Flow pf firewall logs → DC0078 Network Traffic Flow

  macos:osquery Process Events and Launch Daemons → DC0060 Service Creation

  Tunable: LaunchAgentPath PortBindings AppleScriptUsage
  AN0207 ESXi

  ESXi shell execution of tools/scripts (nc, socat, perl) relaying network traffic to other internal hosts, especially when initiated by unauthorized users or VMs.

  esxi:shell /var/log/shell.log → DC0032 Process Creation

  esxi:vmkernel /var/log/vmkernel.log → DC0078 Network Traffic Flow

  NSM:Flow conn.log → DC0082 Network Connection Creation

  Tunable: CLICommandPattern VMInitiator ConnectionDirectionality
  AN0208 Network Devices

  Configuration of internal NAT or proxy rules that redirect traffic between client segments internally (e.g., site-to-site port forwarding). Often used to relay internal beaconing or move traffic laterally through trust zones.

  Firewall Audit Logs Config Change → DC0051 Firewall Rule Modification

  NSM:Flow Inter-segment traffic → DC0078 Network Traffic Flow

  networkdevice:cli Policy Update → DC0064 Command Execution

  Tunable: ProxyTarget ConfigChangeUser FlowThreshold

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1090.001

Rules tagged at the parent level (attack.t1090) 22

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.