Home/ MITRE Matrix/ Command and Control/ T1090

T1090Proxy

T1090 — Proxy is a MITRE ATT&CK technique in the Command and Control tactic. Clankerusecase tracks 13 detection use cases covering it and 6 threat-intel articles citing it.

Command and Control

View on the matrix → Filter Detection Library MITRE official spec ↗

13Use cases

6Articles

4Sub-techniques

1Tactic

Sub-techniques (4)

T1090.004 · Domain Fronting T1090.002 · External Proxy T1090.001 · Internal Proxy T1090.003 · Multi-hop Proxy

Use cases covering this technique (13)

Cisco IOS XE Tunnel Interface Configuration ESCU actions · hunting P Okta Non-Standard VPN Usage ESCU actions · alerting P Linux Ngrok Reverse Proxy Usage ESCU actions · hunting P Linux Proxy Socks Curl ESCU actions · alerting P Windows Devtunnels Execution ESCU actions · hunting P Windows Devtunnels Image Loaded ESCU actions · hunting P Windows Ngrok Reverse Proxy Usage ESCU actions · hunting P Ngrok Reverse Proxy on Network ESCU actions · hunting P [LLM] Evooo1Bot SOCKS5 relay listener on TCP 1080 from a /tmp-resident binary Bespoke c2 · hunting DSΣPCS [LLM] Egress to BTMOB hosted C2 cluster (LATAM/Hetzner IPs, Google CDN excluded) Bespoke c2 · hunting DSPDDCS [LLM] Outbound C2 callback to xygeni-action backdoor IP 91.214.78.178 from CI runner Bespoke c2 · hunting DSΣPDDCS [LLM] DRILLAPP C2: msedge.exe egress to known DRILLAPP IPs or WebSocket to localhost:8000 Bespoke c2 · hunting DSΣPDDCS [LLM] Sandworm SOCKS5 C2 egress to 31.172.71[.]5 (Fornex) or progamevl.ru Bespoke c2 · hunting DSΣPDDCS

Articles citing this technique (6)

crit New Evooo1Bot Linux botnet turns routers into traffic relay nodes art-36

crit BTMOB: A stealthy RAT burrowing deep into Android devices art-443

crit A rigged game: ScarCruft compromises gaming platform in a supply-chain attack art-500

high xygeni-action Compromised: C2 Reverse Shell Backdoor Injected via Tag Poisoning art-598

high DRILLAPP: new backdoor targeting Ukrainian entities with possible links to Laundry Bear art-623

crit DynoWiper update: Technical analysis and attribution art-717