1. Home
  2. ATT&CK Techniques
  3. T1572 Protocol Tunneling

T1572 Protocol Tunneling

Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet.

There are various means to encapsulate a protocol within another protocol. For example, adversaries may perform SSH tunneling (also known as SSH port forwarding), which involves forwarding arbitrary data over an encrypted SSH tunnel.(Citation: SSH Tunneling)

Protocol Tunneling may also be abused by adversaries during Dynamic Resolution. Known as DNS over HTTPS (DoH), queries to resolve C2 infrastructure may be encapsulated within encrypted HTTPS packets.(Citation: BleepingComp Godlua JUL19)

Adversaries may also leverage Protocol Tunneling in conjunction with Proxy and/or Protocol or Service Impersonation to further conceal C2 communications and infrastructure.

View in MITRE ATT&CK®

CRI Profile Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
DE.AE-02.01 Event analysis and detection Mitigates T1572 Protocol Tunneling
Comments
This diagnostic statement provides for implementation of methods to block similar future attacks via security tools such as antivirus and IDS/IPS to provide protection against threats and exploitation attempts.
References
    DE.CM-01.03 Unauthorized network connections and data transfers Mitigates T1572 Protocol Tunneling
    Comments
    This diagnostic statement provides protection from Protocol Tunneling by using tools to detect and block the use of unauthorized devices and connections to prevent abuse by adversaries.
    References
      DE.CM-01.01 Intrusion detection and prevention Mitigates T1572 Protocol Tunneling
      Comments
      This diagnostic statement protects adversaries from using tunneling to encapsulate a protocol within another protocol. Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
      References
        PR.IR-04.01 Utilization monitoring Mitigates T1572 Protocol Tunneling
        Comments
        This diagnostic statement describes how the organization establishes and manages baseline measures of network activity. Supported by network monitoring tools and other controls to detect events and identify incidents. Mitigating mechanisms may include: Data Loss Prevention (DLP); Filtering Network Traffic; Limit Network Traffic; Network Intrusion Prevention Systems (NIPS); and Network Segmentation for these type of network-based techniques.
        References
          PR.IR-04.01 Utilization monitoring Mitigates T1572 Protocol Tunneling
          Comments
          This diagnostic statement describes how the organization establishes and manages baseline measures of network activity. Supported by network monitoring tools and other controls to detect events and identify incidents. Mitigating mechanisms may include: Data Loss Prevention (DLP); Filtering Network Traffic; Limit Network Traffic; Network Intrusion Prevention Systems (NIPS); and Network Segmentation for these type of network-based techniques.
          References
            PR.IR-01.02 Network device configurations Mitigates T1572 Protocol Tunneling
            Comments
            This diagnostic statement provides protection through secure network device configurations (e.g., firewall rules, ports, and protocols) aligned to security baselines. Using network appliances to block or filter network traffic to untrusted or known bad domains and resources can prevent tunnelling of network communications.
            References
              PR.IR-01.03 Network communications integrity and availability Mitigates T1572 Protocol Tunneling
              Comments
              This diagnostic statement protects against Protocol Tunneling through the use of secure network configurations, architecture, implementations of zero trust architecture, and segmentation.
              References
                PR.IR-01.04 Wireless network protection Mitigates T1572 Protocol Tunneling
                Comments
                This diagnostic statement provides protections for wireless networks. Implementation of wireless network management measures such as network segmentation and access controls reduces the attack surface, restricts movement by adversaries, and protects data from compromise.
                References
                  PR.PS-01.08 End-user device protection Mitigates T1572 Protocol Tunneling
                  Comments
                  This diagnostic statement protects against Protocol Tunneling through the use of limiting access to resources to only authorized devices, management of personal computing devices, network intrusion prevention, and the use of antimalware.
                  References

                    NIST 800-53 Mappings

                    Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                    CA-07 Continuous Monitoring mitigates T1572 Protocol Tunneling
                    CM-06 Configuration Settings mitigates T1572 Protocol Tunneling
                    SI-10 Information Input Validation mitigates T1572 Protocol Tunneling
                    SI-15 Information Output Filtering mitigates T1572 Protocol Tunneling
                    SI-03 Malicious Code Protection mitigates T1572 Protocol Tunneling
                    CM-02 Baseline Configuration mitigates T1572 Protocol Tunneling
                    CM-07 Least Functionality mitigates T1572 Protocol Tunneling
                    SI-04 System Monitoring mitigates T1572 Protocol Tunneling
                    AC-03 Access Enforcement mitigates T1572 Protocol Tunneling
                    AC-04 Information Flow Enforcement mitigates T1572 Protocol Tunneling
                    SC-07 Boundary Protection mitigates T1572 Protocol Tunneling

                    VERIS Mappings

                    Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                    action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1572 Protocol Tunneling
                    action.hacking.vector.Other network service Network service that is not remote access or a web application. related-to T1572 Protocol Tunneling
                    action.malware.variety.Backdoor or C2 Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. related-to T1572 Protocol Tunneling
                    action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1572 Protocol Tunneling

                    Azure Mappings

                    Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                    alerts_for_dns Alerts for DNS technique_scores T1572 Protocol Tunneling
                    Comments
                    Can identify protocol misuse/anomalies in DNS. Because this detection is specific to DNS, its coverage score is Minimal resulting in an overall Minimal score.
                    References
                    1. https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-dns

                    GCP Mappings

                    Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                    cloud_ngfw Cloud Next-Generation Firewall (NGFW)_ technique_scores T1572 Protocol Tunneling
                    Comments
                    Cloud NGFW can allow or deny traffic based on the traffic's protocol, destination ports, sources, and destinations. This functionality can be used to block traffic from known bad IP addresses and domains which could protect against protocol tunneling by adversaries. This mapping is given a score of partial because it only blocks known bad IP addresses and domains and does not protect against unknown ones.
                    References
                    1. ['https://cloud.google.com/firewalls']

                    AWS Mappings

                    Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                    aws_network_firewall AWS Network Firewall technique_scores T1572 Protocol Tunneling
                    Comments
                    AWS Network Firewall has the ability to pass, drop, or alert on traffic based on the network protocol as well as perform deep packet inspection on the payload. This functionality can be used to block traffic from known bad IP addresses and domains which could protect against protocol tunneling by adversaries. This mapping is given a score of partial because it only blocks known bad IP addresses and domains and does not protect against unknown ones.
                    References
                    1. https://docs.aws.amazon.com/network-firewall/latest/developerguide/what-is-aws-network-firewall.html