Home/ MITRE Matrix/ Command and Control/ T1090.001

T1090.001Internal Proxy

T1090.001 — Internal Proxy is a MITRE ATT&CK technique in the Command and Control tactic. Clankerusecase tracks 4 detection use cases covering it and 2 threat-intel articles citing it.

Command and Control

View on the matrix → Filter Detection Library MITRE official spec ↗

4Use cases

2Articles

0Sub-techniques

1Tactic

↑ Parent technique: T1090 · Proxy

Use cases covering this technique (4)

Windows Proxy Via Netsh ESCU actions · hunting P Windows Proxy Via Registry ESCU actions · hunting P [LLM] Webworm 2025 IOC match — known C2 IPs (Vultr/IT7) and file hashes Bespoke c2 · hunting DSΣPDDCS [LLM] rsocx SOCKS5 reverse proxy beacon to 31.172.71.5:8008 (Sandworm Poland C2) Bespoke c2 · alerting DSΣP

Articles citing this technique (2)

crit Webworm: New burrowing techniques art-459

high ESET Research: Sandworm behind cyberattack on Poland’s power grid in late 2025 art-728