Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Command and Control/ T1572

T1572Protocol Tunneling

T1572 — Protocol Tunneling is a MITRE ATT&CK technique in the Command and Control tactic. Clankerusecase tracks 19 detection use cases covering it and 7 threat-intel articles citing it.

Command and Control
View on the matrix → Filter Detection Library MITRE official spec ↗
19Use cases
7Articles
0Sub-techniques
1Tactic

Use cases covering this technique (19)

[WEEKLY] Cross-category credential-store enumeration with rapid egress to anonymizing tunnel/CDN Internal actions · alerting DSP [WEEKLY] Internet-Facing Service Process Spawning Unix Shell or Ingress-Tool LOLBin (Edge Zero-Day Post-Exploit) Internal install · alerting DSΣPDD Cisco IOS XE Tunnel Interface Configuration ESCU actions · hunting P Okta Non-Standard VPN Usage ESCU actions · alerting P Linux Ngrok Reverse Proxy Usage ESCU actions · hunting P Windows Ngrok Reverse Proxy Usage ESCU actions · hunting P Windows Potential Cloudflared Network Connection ESCU actions · hunting P Windows Potential Cloudflared Tunnel Execution ESCU actions · hunting P Windows Protocol Tunneling with Plink ESCU actions · alerting P Windows SoftEther VPN Masquerading as Legitimate Binary ESCU actions · alerting P Windows SSH Proxy Command ESCU actions · hunting P Ngrok Reverse Proxy on Network ESCU actions · hunting P [LLM] esxi.sh downloader deploys architecture-specific reverse_ssh from 185.144.28.120 Bespoke install · hunting DSΣPDDCS [LLM] DNS tunneling: high-volume long/high-entropy subdomain queries to a single parent domain Bespoke c2 · hunting DSΣPCS [LLM] Endpoint issuing DNS directly to unauthorised/external resolvers (resolver bypass) Bespoke c2 · hunting DSΣPDDCS [LLM] msaRAT CDP abuse: headless Chrome/Edge with remote-debugging port spawned by non-browser parent Bespoke c2 · alerting DSΣPDDCS [LLM] Webworm 2025 IOC match — known C2 IPs (Vultr/IT7) and file hashes Bespoke c2 · hunting DSΣPDDCS [LLM] GPT-Proxy backdoor C2 / Stage-2 download (sync.geeker.indevs.in, gibunxi4201/kube-node-diag) Bespoke c2 · alerting DSΣPDD [LLM] rsocx SOCKS5 reverse proxy beacon to 31.172.71.5:8008 (Sandworm Poland C2) Bespoke c2 · alerting DSΣP

Articles citing this technique (7)

crit Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware art-28
crit Network Anomaly Detection in KATA art-159
crit IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains art-188
high Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel art-218
crit Webworm: New burrowing techniques art-459
high GPT-Proxy Backdoor in npm and PyPI turns Servers into Chinese LLM Relays art-534
high ESET Research: Sandworm behind cyberattack on Poland’s power grid in late 2025 art-728