T1090 Proxy Mappings

Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.

Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.



Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name
AC-3 Access Enforcement Protects T1090 Proxy
AC-4 Information Flow Enforcement Protects T1090 Proxy
CA-7 Continuous Monitoring Protects T1090 Proxy
CM-2 Baseline Configuration Protects T1090 Proxy
CM-6 Configuration Settings Protects T1090 Proxy
CM-7 Least Functionality Protects T1090 Proxy
SC-7 Boundary Protection Protects T1090 Proxy
SC-8 Transmission Confidentiality and Integrity Protects T1090 Proxy
SI-10 Information Input Validation Protects T1090 Proxy
SI-15 Information Output Filtering Protects T1090 Proxy
SI-3 Malicious Code Protection Protects T1090 Proxy
SI-4 System Monitoring Protects T1090 Proxy
action.hacking.variety.Use of backdoor or C2 Use of Backdoor or C2 channel related-to T1090 Proxy
action.hacking.vector.Backdoor or C2 Backdoor or command and control channel related-to T1090 Proxy
action.malware.variety.C2 Command and control (C2) related-to T1090 Proxy
amazon_guardduty Amazon GuardDuty technique_scores T1090 Proxy
amazon_virtual_private_cloud Amazon Virtual Private Cloud technique_scores T1090 Proxy
aws_web_application_firewall AWS Web Application Firewall technique_scores T1090 Proxy
aws_network_firewall AWS Network Firewall technique_scores T1090 Proxy

ATT&CK Subtechniques

Technique ID Technique Name Number of Mappings
T1090.004 Domain Fronting 2
T1090.002 External Proxy 13
T1090.001 Internal Proxy 11
T1090.003 Multi-hop Proxy 13