T1090.001 — Internal Proxy

Tactic: Command and Control · Platforms: ESXi, Linux, macOS, Network Devices, Windows

Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use internal proxies to…

Sub-technique of Proxy (T1090).

Sigma detection rules (5)

T1090.001 Proxy: Internal Proxy

title: "T1090.001 Proxy: Internal Proxy"
id: eb3e2a91-f639-4c5c-9873-c573bc425b83
description: 'Internal Proxy Behavior via Lateral Host-to-Host C2 Relay. (Data Component: Network Connection Creation; baseline tier: windows-eventid.) Tune using: InternalConnectionPattern, DestinationPort, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1090/001
author: Shahrukh Khan
date: 2026-05-10
license: MIT
tags:
  - attack.command-and-control
  - attack.t1090.001

logsource:
  category: network_connection
  product: windows
  service: sysmon

detection:
  selection:
    EventID: 3
  selection_internal_dest:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  selection_relay_indicators:
    - DestinationPort:
        - 445
        - 135
        - 139
    - Image|endswith:
        - '\htran.exe'
        - '\zxproxy.exe'
        - '\zxportmap.exe'
        - '\plink.exe'
        - '\chisel.exe'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and selection_internal_dest and selection_relay_indicators and not filter_system_account

falsepositives:
  - Legitimate internal SMB/RPC (445/135/139) administrative traffic and authorized use of SSH/tunneling tools between internal hosts; system and service accounts are excluded via filter_system_account. Tune further with host-pair allowlists if noise remains.

level: medium

T1090.001 Proxy: Internal Proxy

title: "T1090.001 Proxy: Internal Proxy"
id: 793219ff-321d-4031-b9ec-b920ccbee555
description: 'Internal Proxy Behavior via Lateral Host-to-Host C2 Relay. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: UserContext, PortRange, ProcessPattern.'
references:
  - https://attack.mitre.org/techniques/T1090/001
author: Shahrukh Khan
date: 2026-04-26
license: MIT
tags:
  - attack.command-and-control
  - attack.t1090.001

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith: '/ssh'
    a1|contains: '-D'
  selection_socat:
    type: EXECVE
    a0|endswith: '/socat'
    a1|contains: 'TCP-LISTEN'

  condition: 1 of selection*

falsepositives:
  - Internal SOCKS/relay proxying via ssh -D or socat listeners is a normal developer workflow; port-range and user-context tuning must be applied SIEM-side.

level: low

T1090.001 Proxy: Internal Proxy

title: "T1090.001 Proxy: Internal Proxy"
id: ec0d4d98-50d9-4d47-b8ac-510dfb7839e0
description: 'Internal Proxy Behavior via Lateral Host-to-Host C2 Relay. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: LaunchAgentPath, PortBindings, AppleScriptUsage.'
references:
  - https://attack.mitre.org/techniques/T1090/001
author: Shahrukh Khan
date: 2026-01-20
license: MIT
tags:
  - attack.command-and-control
  - attack.t1090.001

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/ssh'
    CommandLine|contains|all:
      - '-D '
      - '127.0.0.1'

  condition: selection

falsepositives:
  - Internal SOCKS tunneling for approved remote development environments creates the same pattern.

level: medium

T1090.001 Proxy: Internal Proxy

title: "T1090.001 Proxy: Internal Proxy"
id: fc8ce995-f337-4635-85ce-e8f7b3869fa1
description: 'Internal Proxy Behavior via Lateral Host-to-Host C2 Relay. (Data Component: Firewall Rule Modification; baseline tier: fallback.) Tune using: ProxyTarget, ConfigChangeUser, FlowThreshold.'
references:
  - https://attack.mitre.org/techniques/T1090/001
author: Shahrukh Khan
date: 2026-05-17
license: MIT
tags:
  - attack.command-and-control
  - attack.t1090.001

logsource:
  product: nsm
  service: firewall

detection:
  selection:
    action: 'allow'
    app:
      - 'proxy'
      - 'socks'
    src_ip|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
    dst_ip|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'

  condition: selection

falsepositives:
  - Sanctioned internal proxy servers or caching appliances that legitimately relay traffic between internal network segments.

level: medium

T1090.001 Proxy: Internal Proxy

title: "T1090.001 Proxy: Internal Proxy"
id: 5824adff-03ff-4545-bf98-5030313e800e
description: 'Internal Proxy Behavior via Lateral Host-to-Host C2 Relay. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: CLICommandPattern, VMInitiator, ConnectionDirectionality.'
references:
  - https://attack.mitre.org/techniques/T1090/001
author: Shahrukh Khan
date: 2026-04-05
license: MIT
tags:
  - attack.command-and-control
  - attack.t1090.001

logsource:
  product: esxi
  service: shell

detection:
  selection:
    CommandLine|contains: 'ssh -L'
  selection_internal:
    CommandLine|re: '-L\s*\d+:(10\.|172\.1[6-9]\.|172\.2[0-9]\.|172\.3[0-1]\.|192\.168\.)'

  condition: selection and selection_internal

falsepositives:
  - Administrators forwarding management ports to other internal hosts for troubleshooting will also match this pattern.

level: medium

Related sub-techniques

Explore