T1090.003 — Multi-hop Proxy

Tactic: Command and Control · Platforms: ESXi, Linux, macOS, Network Devices, Windows

Adversaries may chain together multiple proxies to disguise the source of malicious traffic. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop…

Sub-technique of Proxy (T1090).

Sigma detection rules (5)

title: "T1090.003 Proxy: Multi-hop Proxy"
id: ffcb3421-84fe-4847-9a6c-751ef1cc58fd
description: 'Detects Tor client execution and connections to well-known Tor ports. (Data Component: Network Connection Creation; baseline tier: windows-eventid.) Tune using: DomainCategory, ProcessParent, ConnectionDuration.'
references:
  - https://attack.mitre.org/techniques/T1090/003
author: Shahrukh Khan
date: 2026-01-03
license: MIT
tags:
  - attack.command-and-control
  - attack.t1090.003

logsource:
  category: network_connection
  product: windows
  service: sysmon

detection:
  selection_tor_process:
    Image|endswith:
      - '\tor.exe'
      - '\torify.exe'
  selection_tor_ports:
    DestinationPort:
      - 9001
      - 9030
      - 9050
      - 9051
      - 9150
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: (selection_tor_process or selection_tor_ports) and not filter_system_account

falsepositives:
  - Legitimate Tor Browser usage.

level: medium

title: "T1090.003 Proxy: Multi-hop Proxy"
id: cdbef9fc-0f65-4299-8b4a-b7876320518b
description: 'Multi-hop Proxy Behavior via Onion Routing (Tor client execution). Split from the SSH jump-host (-J) signal, which is a common, low-signal bastion-host pattern and is now covered by a separate lower-severity companion rule requiring an actual multi-hop chain. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ExecutablePath, RelayCount, ProtocolType.'
references:
  - https://attack.mitre.org/techniques/T1090/003
author: Shahrukh Khan
date: 2026-03-31
license: MIT
tags:
  - attack.command-and-control
  - attack.t1090.003

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/tor'
      - '/tor.real'

  condition: selection

falsepositives:
  - Tor client execution on a server is rare and more suspicious than routine bastion-host jumping, but still occurs in legitimate research/anonymity use cases; relay-count/protocol-type tuning needs external context auditd cannot supply.

level: high
---
title: "T1090.003 Proxy: Multi-hop Proxy - SSH Multi-hop Jump Chain"
id: 7f2c9d3e-1a4b-4c9d-8e3f-2b6a9d4c1f7e
description: 'Companion to cdbef9fc-0f65-4299-8b4a-b7876320518b: detects SSH ProxyJump (-J) invocations that chain through two or more comma-separated jump hosts in a single command, distinguishing an actual multi-hop relay chain from the very common single-hop bastion-host jump pattern (ssh -J bastion target), which is intentionally excluded here to reduce noise.'
references:
  - https://attack.mitre.org/techniques/T1090/003
author: Shahrukh Khan
date: 2026-03-31
license: MIT
tags:
  - attack.command-and-control
  - attack.t1090.003

logsource:
  category: process_creation
  product: linux

detection:
  selection_jump:
    type: EXECVE
    a0|endswith: '/ssh'
    a1|contains: '-J'
  selection_chain:
    - a1|contains: ','
    - a2|contains: ','

  condition: selection_jump and selection_chain

falsepositives:
  - Rare legitimate cases where an admin manually chains through multiple bastion hosts in one command instead of using ~/.ssh/config ProxyJump chaining; still far less common than single-hop bastion use.

level: low

title: "T1090.003 Proxy: Multi-hop Proxy"
id: ff27cb02-ce58-4da1-bc83-8e1f5cd866ed
description: 'Multi-hop Proxy Behavior via Relay Node Chaining, Onion Routing, and Network Tunneling. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: LaunchdLabel, UnsignedBinary, SOCKSPortUsage.'
references:
  - https://attack.mitre.org/techniques/T1090/003
author: Shahrukh Khan
date: 2026-02-04
license: MIT
tags:
  - attack.command-and-control
  - attack.t1090.003

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/tor'
      - '/torsocks'

  condition: selection

falsepositives:
  - Privacy-conscious users or security researchers intentionally running Tor for legitimate anonymity needs.

level: high

title: "T1090.003 Proxy: Multi-hop Proxy"
id: 2bbbf558-8a3f-4d1e-a316-c860a17ee32c
description: 'Multi-hop Proxy Behavior via Relay Node Chaining, Onion Routing, and Network Tunneling. (Data Component: Network Traffic Flow; baseline tier: fallback.) Tune using: VPNConfigWhitelist, ICMPPayloadEntropy, RelayChainSignature.'
references:
  - https://attack.mitre.org/techniques/T1090/003
author: Shahrukh Khan
date: 2026-02-06
license: MIT
tags:
  - attack.command-and-control
  - attack.t1090.003

logsource:
  product: nsm
  service: flow

detection:
  selection_tor_port:
    id.resp_p:
      - 9001
      - 9030
      - 9050
  selection_ssl:
    service: 'ssl'
  condition: selection_tor_port and selection_ssl

falsepositives:
  - Security researchers or privacy tooling on the network legitimately operating a Tor relay or client will also match these ports and protocol.

level: high

title: "T1090.003 Proxy: Multi-hop Proxy"
id: 5c58cb5f-1a6b-4835-9913-f1438f0b104b
description: 'Multi-hop Proxy Behavior via Relay Node Chaining, Onion Routing, and Network Tunneling. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: HopCount, ShellAccess, VPSIPRange.'
references:
  - https://attack.mitre.org/techniques/T1090/003
author: Shahrukh Khan
date: 2026-05-07
license: MIT
tags:
  - attack.command-and-control
  - attack.t1090.003

logsource:
  product: esxi
  service: shell

detection:
  selection:
    CommandLine|contains: 'ssh -J'
  selection_chain:
    CommandLine|contains: '@'

  condition: selection and selection_chain

falsepositives:
  - ESXi host logs cannot enumerate multi-hop path length or identify VPS or Tor egress ranges, so this only detects explicit ProxyJump usage in an interactively logged SSH command, not chained sessions initiated elsewhere.

level: medium

Related sub-techniques

• T1090.004 Domain Fronting
• T1090.002 External Proxy
• T1090.001 Internal Proxy

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1090.003 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan