T1665 — Hide Infrastructure

Tactic: Command and Control · Platforms: ESXi, Linux, macOS, Network Devices, Windows

Adversaries may manipulate network traffic in order to hide and evade detection of their C2 infrastructure. This can be accomplished by identifying and filtering traffic from defensive tools, masking malicious domains to obfuscate the true destination from both automated scanning tools and…

Sigma detection rules (5)

title: T1665 Hide Infrastructure
id: c057f95a-12bb-4ab0-912d-8d835497ea9e
description: 'Detects DNS responses (Sysmon EventID 22) returning an unusually high number of distinct resolved IP addresses for a single query, a heuristic for fast-flux/round-robin DNS and other IP-rotation techniques adversaries use to hide C2 infrastructure from static blocklists and takedown. Note: most other infrastructure-hiding sub-behaviors (domain fronting, EDR/scanner traffic filtering, TLS SNI manipulation) are not observable in Windows host telemetry at all; this rule targets only the one sub-behavior -- DNS/IP churn -- that is. Retargeted from a blanket EventID 5156/5157 firewall-log match, which had no infrastructure-hiding signal at all. (Data Component: Network Connection Creation; baseline tier: windows-eventid.) Tune using: SuspiciousDomains, ResponderIPs, AnswerCountThreshold.'
references:
  - https://attack.mitre.org/techniques/T1665
author: Shahrukh Khan
date: 2026-04-23
license: MIT
tags:
  - attack.command-and-control
  - attack.t1665

logsource:
  category: dns_query
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '22'

  selection_high_answer_count:
    QueryResults|re: '^(.*;){5,}.*
    
  



  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and selection_high_answer_count and not filter_system_account

falsepositives:
  - Legitimate CDN, load-balanced, or anycast services (large SaaS providers, cloud front-ends) commonly return many A/AAAA records per query; this rule is a coarse fast-flux/IP-churn heuristic and needs domain allowlisting (SuspiciousDomains) before it is actionable. System and service accounts are excluded via filter_system_account.

level: medium

title: T1665 Hide Infrastructure
id: 9a140192-a071-44a9-8bce-91665801d190
description: 'Detection Strategy for Hide Infrastructure: traffic-filtering artifacts used to hide C2 infrastructure from defenders/researchers (blocking/redirecting known scanner or security-tool User-Agents, geo-fencing rules), not proxy/tunnel establishment. The prior rule (ssh/socat/ngrok/chisel/frpc with reverse-relay flags) actually describes Proxy (T1090)/Protocol Tunneling (T1572) behavior. Retargeted to web-server config edits that add User-Agent- or GeoIP-based filtering/redirect directives (mod_rewrite conditions, nginx map/geo blocks) to .htaccess/nginx site configs. Tune using: BlockedAgents.'
references:
  - https://attack.mitre.org/techniques/T1665
author: Shahrukh Khan
date: 2026-03-13
license: MIT
tags:
  - attack.command-and-control
  - attack.t1665

logsource:
  category: process_creation
  product: linux

detection:
  selection_config_edit:
    type: EXECVE
    a0|endswith:
      - '/sed'
      - '/vi'
      - '/vim'
      - '/echo'
      - '/tee'
  selection_target_config:
    a1|contains:
      - '.htaccess'
      - 'nginx.conf'
      - 'sites-enabled'
      - 'sites-available'
  selection_filtering_directive:
    a2|contains:
      - 'RewriteCond'
      - 'HTTP_USER_AGENT'
      - 'geoip'
      - 'GeoIP'
      - 'geo 
    
  


      - 'map $http_user_agent'

  condition: selection_config_edit and selection_target_config and selection_filtering_directive

falsepositives:
  - Legitimate bot-blocking or SEO/analytics User-Agent rules added by admins for reasons unrelated to hiding malicious infrastructure; scope BlockedAgents to known researcher/scanner/security-tool user-agent strings specifically.

level: medium

title: T1665 Hide Infrastructure
id: e9a26409-96f3-40b2-86df-431a0a2691cf
description: 'Detection Strategy for Hide Infrastructure. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TrustedHostingProviders.'
references:
  - https://attack.mitre.org/techniques/T1665
author: Shahrukh Khan
date: 2026-06-14
license: MIT
tags:
  - attack.command-and-control
  - attack.t1665

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/curl'
    CommandLine|contains|all:
      - '-H'
      - 'Host:'

  condition: selection

falsepositives:
  - Web developers and API testers routinely set a custom Host header manually with curl for legitimate virtual-host testing, and domain fronting or CDN abuse otherwise looks identical to normal CDN traffic.

level: medium

title: T1665 Hide Infrastructure
id: d2cc21fc-f001-4383-a885-d5734e07f8a8
description: 'Detection Strategy for Hide Infrastructure. (Data Component: Network Traffic Content; baseline tier: fallback.) Tune using: GeoIPRanges.'
references:
  - https://attack.mitre.org/techniques/T1665
author: Shahrukh Khan
date: 2026-04-09
license: MIT
tags:
  - attack.command-and-control
  - attack.t1665

logsource:
  product: nsm
  service: flow

detection:
  selection_ssl:
    service: 'ssl'
  filter_known_cdn:
    server_name|endswith:
      - '.cloudfront.net'
      - '.akamai.net'

  condition: selection_ssl and not filter_known_cdn

falsepositives:
  - Legitimate use of unfamiliar foreign cloud or CDN endpoints for approved business SaaS applications; requires real GeoIP enrichment against an approved country list to be actionable.

level: low

title: T1665 Hide Infrastructure
id: 759398a3-b2bc-4238-9b1b-61da0da7be12
description: 'Detection Strategy for Hide Infrastructure. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: MonitoredVMs.'
references:
  - https://attack.mitre.org/techniques/T1665
author: Shahrukh Khan
date: 2026-01-28
license: MIT
tags:
  - attack.command-and-control
  - attack.t1665

logsource:
  product: esxi
  service: hostd

detection:
  selection:
    Message|contains:
      - 'ReconfigVM'
      - 'renamed'

  condition: selection

falsepositives:
  - Legitimate renaming of VM display names or network labels during normal lifecycle management on MonitoredVMs; hostd.log records the reconfiguration event but cannot assess intent to blend attacker infrastructure into the inventory.

level: low

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1665 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan