T1090 Proxy

Technique

T1090

Tactics

Command and Control

Research, 90 days

4

KEV CVEs mapped

3

SigmaHQ rules

22

Elastic, Splunk

30

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1090

MITRE description

Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap.(Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic. Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.

KEV CVEs mapped to this technique

MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.

• CVE-2021-26855
• CVE-2021-22986
• CVE-2019-3396

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-11-03 Flare: Inside a Microsoft Lookalike Domain Masquerading as Czech Company’s IT Department Infrastructure
• 2026-10-29 Cisco Talos: IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
• 2026-10-22 Group-IB: Inside SiriusQT: A Seriously Skilled RAT
• 2026-09-25 Google Threat Intelligence: ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft

Detection coverage

SigmaHQ community rules

• Kalambur Backdoor Curl TOR SOCKS Proxy Execution (emerging-threats)
• OpenCanary - HTTPPROXY Login Attempt (core)
• Malicious IP Address Sign-In Suspicious (core)
• Malicious IP Address Sign-In Failure Rate (core)
• Sign-In From Malware Infected IP (core)
• Communication To LocaltoNet Tunneling Service Initiated - Linux (core)
• Communication To Ngrok Tunneling Service - Linux (core)
• Connection Proxy (core)
• Ngrok Usage with Remote Desktop Service (core)
• Communication To LocaltoNet Tunneling Service Initiated (core)
• Communication To Ngrok Tunneling Service Initiated (core)
• Suspicious TCP Tunnel Via PowerShell Script (core)
• Cloudflared Tunnel Connections Cleanup (core)
• Cloudflared Tunnel Execution (core)
• HackTool - Htran/NATBypass Execution (core)
• RDP Port Forwarding Rule Added Via Netsh.EXE (core)
• New Port Forwarding Rule Added Via Netsh.EXE (core)
• PUA - Fast Reverse Proxy (FRP) Execution (core)
• PUA- IOX Tunneling Tool Execution (core)
• PUA - NPS Tunneling Tool Execution (core)
• Potentially Suspicious Usage Of Qemu (core)
• New PortProxy Registry Entry Added (core)

Elastic and Splunk rules

• Potential Tunneling via AWS IoT Secure Tunneling Localproxy (elastic)
• Kubectl Network Configuration Modification (elastic)
• FortiGate SOCKS Traffic from an Unusual Process (elastic)
• Potential Traffic Tunneling using QEMU (elastic)
• Potential Tunneling via Tailscaled (elastic)
• Curl SOCKS Proxy Detected via Defend for Containers (elastic)
• Tunneling and/or Port Forwarding Detected via Defend for Containers (elastic)
• Curl SOCKS Proxy Activity from Unusual Parent (elastic)
• Unusual DNS Request to Suspicious Top Level Domain (elastic)
• IPv4/IPv6 Forwarding Activity (elastic)
• Potential Protocol Tunneling via Chisel Client (elastic)
• ProxyChains Activity (elastic)
• Suspicious Utility Launched via ProxyChains (elastic)
• Potential Linux Tunneling and/or Port Forwarding (elastic)
• Potential Linux Tunneling and/or Port Forwarding via SSH Option (elastic)
• Potential Linux Tunneling and/or Port Forwarding via Command Line (elastic)
• Potential Protocol Tunneling via EarthWorm (elastic)
• Connection to Commonly Abused Web Services (elastic)
• Potential SSH Reverse Port Forwarding (elastic)
• Port Forwarding Rule Addition (elastic)
• Potential Protocol Tunneling via Cloudflared (elastic)
• Potential Protocol Tunneling via Yuze (elastic)
• DNS to Commonly Abused Web Services (elastic)
• Cisco IOS XE Tunnel Interface Configuration (splunk)
• Linux Ngrok Reverse Proxy Usage (splunk)

Showing 25 of 30.

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.