T1572 — Protocol Tunneling

Tactic: Command and Control · Platforms: ESXi, Linux, macOS, Windows

Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal…

Sigma detection rules (4)

T1572 Protocol Tunneling

title: T1572 Protocol Tunneling
id: da55f2fc-23b1-43f9-a098-561ab92da922
description: 'Detection Strategy for Protocol Tunneling accross OS platforms.. (Retargeted from the original process_creation label to network_connection — this is the telemetry source that actually captures this technique''s behavior; see logsource below.) Tune using: AllowedTools, DataAsymmetryThreshold, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1572
author: Shahrukh Khan
date: 2026-02-02
license: MIT
tags:
  - attack.command-and-control
  - attack.t1572

logsource:
  category: network_connection
  product: windows
  service: sysmon

detection:
  selection:
    Image|endswith:
      - '\plink.exe'
      - '\ssh.exe'
    CommandLine|contains: '-R'

  condition: selection

falsepositives:
  - Legitimate SSH reverse-tunnel usage by developers/IT for remote access — verify against approved use cases.

level: high

T1572 Protocol Tunneling

title: T1572 Protocol Tunneling
id: fe03a83a-aada-4635-92e8-11ccd54cf776
description: 'Detection Strategy for Protocol Tunneling accross OS platforms.. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ForwardingFlags, ProtocolBaseline.'
references:
  - https://attack.mitre.org/techniques/T1572
author: Shahrukh Khan
date: 2026-06-05
license: MIT
tags:
  - attack.command-and-control
  - attack.t1572

logsource:
  category: process_creation
  product: linux

detection:
  selection_ssh:
    type: EXECVE
    a0|endswith: '/ssh'
    a1|contains:
      - '-R'
      - '-L'
      - '-D'
  selection_tunnel:
    type: EXECVE
    a0|endswith:
      - '/chisel'
      - '/ngrok'

  condition: 1 of selection*

falsepositives:
  - SSH port forwarding is routinely used by developers and admins for legitimate remote access; scope to unexpected destination hosts/ports (tune ForwardingFlags/ProtocolBaseline).

level: high

T1572 Protocol Tunneling

title: T1572 Protocol Tunneling
id: 9bac777b-0f58-4a8b-a91e-5edfb118ee23
description: 'Detection Strategy for Protocol Tunneling accross OS platforms.. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ExpectedDoHResolvers, PayloadEntropyThreshold.'
references:
  - https://attack.mitre.org/techniques/T1572
author: Shahrukh Khan
date: 2026-03-25
license: MIT
tags:
  - attack.command-and-control
  - attack.t1572

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/ssh'
    CommandLine|contains:
      - '-R'
      - '-L'
      - '-D'
  selection2:
    Image|endswith:
      - '/ngrok'
      - '/dnscat2'

  condition: 1 of selection*

falsepositives:
  - Developers and administrators routinely use legitimate SSH port forwarding for remote database access or bypassing NAT during approved work.

level: medium

T1572 Protocol Tunneling

title: T1572 Protocol Tunneling
id: 33531b4a-527f-416a-934a-9ee976ec6f51
description: 'Detection Strategy for Protocol Tunneling accross OS platforms.. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ESXiServiceProfiles.'
references:
  - https://attack.mitre.org/techniques/T1572
author: Shahrukh Khan
date: 2026-03-15
license: MIT
tags:
  - attack.command-and-control
  - attack.t1572

logsource:
  product: esxi
  service: shell

detection:
  selection_ssh:
    CommandLine|contains: 'ssh '
  selection_tunnel:
    CommandLine|re: '-[LRD]\s'

  condition: selection_ssh and selection_tunnel

falsepositives:
  - Administrators legitimately using an SSH tunnel to reach a management interface behind the ESXi host during troubleshooting outside the ESXiServiceProfiles baseline; review the destination port and remote endpoint before escalating.

level: high

Explore