T1090.002 — External Proxy

Tactic: Command and Control · Platforms: ESXi, Linux, macOS, Network Devices, Windows

Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and…

Sub-technique of Proxy (T1090).

Sigma detection rules (5)

title: "T1090.002 Proxy: External Proxy"
id: bc22d710-3fb4-495e-8ab4-a7b639330931
description: 'External Proxy Behavior via Outbound Relay to Intermediate Infrastructure. (Data Component: Network Connection Creation; baseline tier: windows-eventid.) Tune using: DestinationASN, ParentProcess, EntropyThreshold.'
references:
  - https://attack.mitre.org/techniques/T1090/002
author: Shahrukh Khan
date: 2026-04-09
license: MIT
tags:
  - attack.command-and-control
  - attack.t1090.002

logsource:
  category: network_connection
  product: windows
  service: sysmon

detection:
  selection:
    EventID: 3
    Image|endswith:
      - '\htran.exe'
      - '\zxproxy.exe'
      - '\zxportmap.exe'
      - '\plink.exe'
      - '\chisel.exe'
      - '\ngrok.exe'
      - '\frpc.exe'
  filter_internal_ip:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
      - '127.0.0.0/8'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_internal_ip and not filter_system_account

falsepositives:
  - Legitimate use of SSH/tunneling utilities (PuTTY/plink, ngrok, chisel) for authorized remote-access or developer tunneling to external hosts; system and service accounts are excluded via filter_system_account. Tune further with destination allowlists if noise remains.

level: medium

title: "T1090.002 Proxy: External Proxy"
id: f4eab38a-2374-4d71-bc20-84b49db9ddb2
description: 'External Proxy Behavior via Outbound Relay to Intermediate Infrastructure. The environment-variable selection is scoped to the only argv-visible form auditd can actually observe - explicit `env HTTP_PROXY=... cmd` invocations - since ordinary shell export/inline assignment (e.g. HTTP_PROXY=x curl ... or export HTTP_PROXY=x) sets process environment, not EXECVE argv, and auditd EXECVE records never capture the environment. Added ssh -D dynamic port forwarding (a common way to stand up an ad hoc SOCKS external proxy) as a supplementary indicator alongside proxychains. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: CommandLinePattern, ExternalIPList, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1090/002
author: Shahrukh Khan
date: 2026-01-11
license: MIT
tags:
  - attack.command-and-control
  - attack.t1090.002

logsource:
  category: process_creation
  product: linux

detection:
  selection_proxychains:
    type: EXECVE
    a0|endswith:
      - '/proxychains'
      - '/proxychains4'
  selection_env_wrapper:
    type: EXECVE
    a0|endswith: '/env'
    a1|contains:
      - 'HTTP_PROXY='
      - 'HTTPS_PROXY='
  selection_ssh_socks:
    type: EXECVE
    a0|endswith: '/ssh'
    a1|contains: '-D'

  condition: 1 of selection_*

falsepositives:
  - proxychains and mandated corporate egress proxies configured via env HTTP_PROXY=... wrapper invocations are legitimate; ssh -D is also routinely used by administrators and developers for legitimate SOCKS tunneling. This rule cannot see HTTP_PROXY/HTTPS_PROXY set via shell export or inline assignment (auditd EXECVE captures argv only, never environment), so it under-detects proxy env-var usage; requires an external-IP allow-list to be actionable.

level: medium

title: "T1090.002 Proxy: External Proxy"
id: 7fc653a2-7e80-4024-95b0-0286a57d41bb
description: 'External Proxy Behavior via Outbound Relay to Intermediate Infrastructure. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: LaunchAgentPath, ExternalPort, ProcessReputation.'
references:
  - https://attack.mitre.org/techniques/T1090/002
author: Shahrukh Khan
date: 2026-06-03
license: MIT
tags:
  - attack.command-and-control
  - attack.t1090.002

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/ssh'
      - '/nc'
    CommandLine|contains: '-R '

  condition: selection

falsepositives:
  - Remote support sessions established through authorized reverse SSH tunnels use the same flags.

level: medium

title: "T1090.002 Proxy: External Proxy"
id: c096df25-81ce-4e62-b4bd-85ea4ff1ec6b
description: 'External Proxy Behavior via Outbound Relay to Intermediate Infrastructure. (Data Component: Firewall Rule Modification; baseline tier: fallback.) Tune using: FlowThreshold, DestinationIPCategory, ConfigChangeUser.'
references:
  - https://attack.mitre.org/techniques/T1090/002
author: Shahrukh Khan
date: 2026-03-20
license: MIT
tags:
  - attack.command-and-control
  - attack.t1090.002

logsource:
  product: nsm
  service: firewall

detection:
  selection:
    action: 'allow'
    app:
      - 'proxy'
      - 'socks'
      - 'tor'

  condition: selection

falsepositives:
  - Sanctioned proxy or SOCKS gateways and privacy tools approved for use in the environment.

level: medium

title: "T1090.002 Proxy: External Proxy"
id: c9bec68d-67a5-4e4a-8275-acb3d9374b48
description: 'External Proxy Behavior via Outbound Relay to Intermediate Infrastructure. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: VMOutboundPatterns, ProxyHostPattern, ConnectionDirectionality.'
references:
  - https://attack.mitre.org/techniques/T1090/002
author: Shahrukh Khan
date: 2026-05-26
license: MIT
tags:
  - attack.command-and-control
  - attack.t1090.002

logsource:
  product: esxi
  service: shell

detection:
  selection:
    CommandLine|contains:
      - 'ssh -D'
      - 'ssh -R'

  condition: selection

falsepositives:
  - ESXi shell rarely has a legitimate business need for outbound proxy tunneling, though administrators occasionally use SSH reverse tunnels for vendor remote support sessions.

level: high

Related sub-techniques

• T1090.004 Domain Fronting
• T1090.003 Multi-hop Proxy
• T1090.001 Internal Proxy

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1090.002 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan