MITRE ATT&CKsub-technique

T1090.001 Internal Proxy

Published 2020-03-14 Modified 2026-09-08 Official page ↗
Domain
enterprise
Tactics
Command And Control
Platforms
ESXi, Linux, macOS, Network Devices, Windows
Version
1.2
Created
2020-03-14

Description

Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use internal proxies to manage command and control communications inside a compromised environment, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between infected systems to avoid suspicion. Internal proxy connections may use common peer-to-peer (p2p) networking protocols, such as SMB, to better blend in with the environment. By using a compromised internal system as a proxy, adversaries may conceal the true destination of C2 traffic while reducing the need for numerous connections to external systems.

Related

Subtechnique of · MITRE ATT&CK (1)

Tactic · MITRE ATT&CK (1)

  • TA0011 Command and Control tactic

Referenced by MITRE ATT&CK · mitigates (1)

  • M1031 Network Intrusion Prevention mitigation

Referenced by MITRE ATT&CK · uses (36)

  • C0064 AI-Assisted Breach of Mexico's Government Infrastructure campaign
  • S9023 HiddenFace software (malware)
  • S9015 BRICKSTORM software (malware)
  • S9010 GlassWorm software (malware)
  • S1227 StarProxy software (malware)
  • G1047 Velvet Ant group
  • C0051 APT28 Nearest Neighbor Campaign campaign
  • S1198 Gomir software (malware)
  • S1100 Ninja software (malware)
  • G1016 FIN13 group
  • G1017 Volt Typhoon group
  • C0024 SolarWinds Compromise campaign
  • S1060 Mafalda software (malware)
  • S1059 metaMain software (malware)
  • C0014 Operation Wocao campaign
  • S0699 Mythic software (tool)
  • S0633 Sliver software (tool)
  • G0126 Higaisa group
  • S0556 Pay2Key software (malware)
  • S0603 Stuxnet software (malware)
  • S0512 FatDuke software (malware)
  • S0502 Drovorub software (malware)
  • G0087 APT39 group
  • S0260 InvisiMole software (malware)
  • S0265 Kazuar software (malware)
  • S0154 Cobalt Strike software (malware)
  • G0010 Turla group
  • G0030 Lotus Blossom group
  • G0032 Lazarus Group group
  • G0041 Strider group
Show all 36 ›

Referenced by CAPEC · att&ck technique (1)

  • CAPEC-465 Transparent Proxy Abuse attack pattern

Referenced by Compliance · mitigates (12)

  • CIS-13.8 Deploy a Network Intrusion Prevention Solution CIS Safeguard v8.1
  • CIS-4.5 Implement and Manage a Firewall on End-User Devices CIS Safeguard v8.1
  • CIS-4.6 Securely Manage Enterprise Assets and Software CIS Safeguard v8.1
  • CIS-4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software CIS Safeguard v8.1
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References