Home/ MITRE Matrix/ Command and Control/ T1090

T1090Proxy

T1090 — Proxy is a MITRE ATT&CK technique in the Command and Control tactic. Clankerusecase tracks 16 detection use cases covering it and 10 threat-intel articles citing it.

Command and Control

View on the matrix → Filter Detection Library MITRE official spec ↗

16Use cases

10Articles

4Sub-techniques

1Tactic

Sub-techniques (4)

T1090.004 · Domain Fronting T1090.002 · External Proxy T1090.001 · Internal Proxy T1090.003 · Multi-hop Proxy

Use cases covering this technique (16)

Cisco IOS XE Tunnel Interface Configuration ESCU actions · hunting P Okta Non-Standard VPN Usage ESCU actions · alerting P Linux Ngrok Reverse Proxy Usage ESCU actions · hunting P Linux Proxy Socks Curl ESCU actions · alerting P Windows Devtunnels Execution ESCU actions · hunting P Windows Devtunnels Image Loaded ESCU actions · hunting P Windows Ngrok Reverse Proxy Usage ESCU actions · hunting P Ngrok Reverse Proxy on Network ESCU actions · hunting P [LLM] BridgeHead SOCKS5 relay drop: unbcl.dll + libwinpthread-1.dll co-located outside System32 Bespoke c2 · alerting DSΣPDDCS [LLM] BridgeHead WebSocket SOCKS5 tunnel to smartconnect.azurewebsites.net with hardcoded Edg/86 UA Bespoke c2 · alerting DSΣPDDCS [LLM] Dysphoria relay node: public-to-public traffic bridging (UPnP port-forwarding relay) Bespoke c2 · hunting DSPCS [LLM] The Gentlemen SystemBC C2 beacon to known operator IPs Bespoke c2 · hunting DSΣPDDCS [LLM] Egress to BTMOB hosted C2 cluster (LATAM/Hetzner IPs, Google CDN excluded) Bespoke c2 · hunting DSPDDCS [LLM] Outbound C2 callback to xygeni-action backdoor IP 91.214.78.178 from CI runner Bespoke c2 · hunting DSΣPDDCS [LLM] DRILLAPP C2: msedge.exe egress to known DRILLAPP IPs or WebSocket to localhost:8000 Bespoke c2 · hunting DSΣPDDCS [LLM] Sandworm SOCKS5 C2 egress to 31.172.71[.]5 (Fornex) or progamevl.ru Bespoke c2 · hunting DSΣPDDCS

Articles citing this technique (10)

crit Nimbus Manticore Deploys NightLedger and Turns Victim Systems Into Covert Relays art-52

crit Mirage Kitten targets Middle East and Africa region with new malware art-56

crit Dysphoria IoT Botnet Adds Blockchain C2 and Victim Relays After JackSkid Disruption art-61

crit HelloNet campaign: new malicious modules launched through the ViPNet update system art-153

crit No Manners Here: The Ruthless Rise of The Gentlemen Ransomware art-199

crit BTMOB: A stealthy RAT burrowing deep into Android devices art-397

crit A rigged game: ScarCruft compromises gaming platform in a supply-chain attack art-455

high xygeni-action Compromised: C2 Reverse Shell Backdoor Injected via Tag Poisoning art-557

high DRILLAPP: new backdoor targeting Ukrainian entities with possible links to Laundry Bear art-590

crit DynoWiper update: Technical analysis and attribution art-684