T1572 Protocol Tunneling

Technique

T1572

Tactics

Command and Control

Research, 90 days

3

KEV CVEs mapped

0

SigmaHQ rules

24

Elastic, Splunk

39

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1572

MITRE description

Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet. There are various means to encapsulate a protocol within another protocol. For example, adversaries may perform SSH tunneling (also known as SSH port forwarding), which involves forwarding arbitrary data over an encrypted SSH tunnel.(Citation: SSH Tunneling)(Citation: Sygnia Abyss Locker 2025) [Protocol Tunneling](https://attack.mitre.org/techniques/T1572) may also be abused by adversaries during [Dynamic Resolution](https://attack.mitre.org/techniques/T1568). Known as DNS over HTTPS (DoH), queries to resolve C2 infrastructure may be encapsulated within encrypted HTTPS packets.(Citation: BleepingComp Godlua JUL19) Adversaries may also leverage [Protocol Tunneling](https://attack.mitre.org/techniques/T1572) in conjunction with [Proxy](https://attack.mitre.org/techniques/T1090) and/or [Protocol or Service Impersonation](https://attack.mitre.org/techniques/T1001/003) to further conceal C2 communications and infrastructure.

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-10-31 Microsoft Threat Intelligence: Inside a malicious Claude Code-branded extension and its persistent SSH backdoor
• 2026-10-29 Cisco Talos: IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
• 2026-10-19 Rapid7: Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

Detection coverage

SigmaHQ community rules

• Tunneling Tool Execution (threat-hunting)
• Communication To LocaltoNet Tunneling Service Initiated - Linux (core)
• Communication To Ngrok Tunneling Service - Linux (core)
• Cloudflared Tunnels Related DNS Requests (core)
• DNS Query To Devtunnels Domain (core)
• Network Connection Initiated To BTunnels Domains (core)
• Network Connection Initiated To Cloudflared Tunnels Domains (core)
• Network Connection Initiated To DevTunnels Domain (core)
• Communication To LocaltoNet Tunneling Service Initiated (core)
• Communication To Ngrok Tunneling Service Initiated (core)
• Process Initiated Network Connection To Ngrok Domain (core)
• Network Connection Initiated To Visual Studio Code Tunnels Domain (core)
• RDP Over Reverse SSH Tunnel (core)
• RDP to HTTP or HTTPS Target Ports (core)
• Silence.EDA Detection (core)
• Cloudflared Tunnel Connections Cleanup (core)
• Cloudflared Tunnel Execution (core)
• Suspicious Plink Port Forwarding (core)
• Potential RDP Tunneling Via Plink (core)
• PUA - 3Proxy Execution (core)
• PUA - Ngrok Execution (core)
• Potentially Suspicious Usage Of Qemu (core)
• Port Forwarding Activity Via SSH.EXE (core)
• Potential RDP Tunneling Via SSH (core)

Elastic and Splunk rules

• Potential Tunneling via AWS IoT Secure Tunneling Localproxy (elastic)
• Kubectl Network Configuration Modification (elastic)
• Potential Traffic Tunneling using QEMU (elastic)
• Potential Tunneling via Tailscaled (elastic)
• Curl SOCKS Proxy Detected via Defend for Containers (elastic)
• Tunneling and/or Port Forwarding Detected via Defend for Containers (elastic)
• Curl SOCKS Proxy Activity from Unusual Parent (elastic)
• IPv4/IPv6 Forwarding Activity (elastic)
• Potential Protocol Tunneling via Chisel Client (elastic)
• ProxyChains Activity (elastic)
• Linux SSH X11 Forwarding (elastic)
• Suspicious Utility Launched via ProxyChains (elastic)
• Potential Linux Tunneling and/or Port Forwarding (elastic)
• Potential Linux Tunneling and/or Port Forwarding via SSH Option (elastic)
• Potential Linux Tunneling and/or Port Forwarding via Command Line (elastic)
• Potential Protocol Tunneling via EarthWorm (elastic)
• DNS Tunneling (elastic)
• Potential DNS Tunneling via NULL or Long DNS Queries (elastic)
• Newly Observed IPSEC NAT Traversal Peer (elastic)
• Potential ICMP Tunneling Activity to the Internet (elastic)
• Potential DNS Tunneling via NsLookup (elastic)
• Potential SSH Reverse Port Forwarding (elastic)
• Port Forwarding Rule Addition (elastic)
• Potential Remote Desktop Tunneling Detected (elastic)
• Potential Protocol Tunneling via Cloudflared (elastic)

Showing 25 of 39.

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.