MITRE ATT&CKtechnique

T1572 Protocol Tunneling

Published 2020-03-15 Modified 2026-09-03 Official page ↗
Domain
enterprise
Tactics
Command And Control
Platforms
ESXi, Linux, macOS, Windows
Version
1.1
Created
2020-03-15

Description

Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet. There are various means to encapsulate a protocol within another protocol. For example, adversaries may perform SSH tunneling (also known as SSH port forwarding), which involves forwarding arbitrary data over an encrypted SSH tunnel. Protocol Tunneling may also be abused by adversaries during Dynamic Resolution. Known as DNS over HTTPS (DoH), queries to resolve C2 infrastructure may be encapsulated within encrypted HTTPS packets. Adversaries may also leverage Protocol Tunneling in conjunction with Proxy and/or Protocol or Service Impersonation to further conceal C2 communications and infrastructure.

Related

Tactic · MITRE ATT&CK (1)

  • TA0011 Command and Control tactic

Referenced by MITRE ATT&CK · mitigates (2)

  • M1037 Filter Network Traffic mitigation
  • M1031 Network Intrusion Prevention mitigation

Referenced by MITRE ATT&CK · uses (44)

  • S9061 LIGHTRAIL software (malware)
  • C0064 AI-Assisted Breach of Mexico's Government Infrastructure campaign
  • G1055 VOID MANTICORE group
  • S9023 HiddenFace software (malware)
  • S9024 SPAWNCHIMERA software (malware)
  • S9015 BRICKSTORM software (malware)
  • C0058 SharePoint ToolShell Exploitation campaign
  • G1045 Salt Typhoon group
  • S1187 reGeorg software (malware)
  • S1189 Neo-reGeorg software (malware)
  • S1144 FRP software (tool)
  • S1141 LunarWeb software (malware)
  • C0032 C0032 campaign
  • C0034 2022 Ukraine Electric Power Attack campaign
  • C0029 Cutting Edge campaign
  • G1021 Cinnamon Tempest group
  • S0508 ngrok software (tool)
  • G1016 FIN13 group
  • G1015 Scattered Spider group
  • C0027 C0027 campaign
  • S1063 Brute Ratel C4 software (tool)
  • S1044 FunnyDream software (malware)
  • C0004 CostaRicto campaign
  • S1027 Heyoka Backdoor software (malware)
  • S1020 Kevin software (malware)
  • G1003 Ember Bear group
  • S1015 Milan software (malware)
  • S0699 Mythic software (tool)
  • S0687 Cyclops Blink software (malware)
  • S0650 QakBot software (malware)
Show all 44 ›

Referenced by Compliance · mitigates (19)

  • CIS-13.10 Perform Application Layer Filtering CIS Safeguard v8.1
  • CIS-13.4 Perform Traffic Filtering Between Network Segments CIS Safeguard v8.1
  • CIS-13.8 Deploy a Network Intrusion Prevention Solution CIS Safeguard v8.1
  • CIS-4.4 Implement and Manage a Firewall on Servers CIS Safeguard v8.1
  • CIS-4.5 Implement and Manage a Firewall on End-User Devices CIS Safeguard v8.1
  • CIS-4.6 Securely Manage Enterprise Assets and Software CIS Safeguard v8.1
  • CIS-4.9 Configure Trusted DNS Servers on Enterprise Assets CIS Safeguard v8.1
  • CIS-9.2 Use DNS Filtering Services CIS Safeguard v8.1
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-10 Information Input Validation NIST 800-53 control
  • NIST-SI-15 Information Output Filtering NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References