ATT&CK technique
View on MITRE ATT&CK →
T1090.002
External Proxy
Command and Control
9 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Connection to Commonly Abused Web Services | production | 2026-10-19 |
| splunk | Cisco Secure Firewall - Connection to File Sharing Domain | production | 2026-10-08 |
| elastic | Unusual DNS Request to Suspicious Top Level Domain | production | 2026-09-18 |
| elastic | Potential Protocol Tunneling via Cloudflared | production | 2026-09-18 |
| elastic | Potential Tunneling via AWS IoT Secure Tunneling Localproxy | production | 2026-09-18 |
| elastic | Potential SSH Reverse Port Forwarding | production | 2026-09-18 |
| elastic | Curl SOCKS Proxy Activity from Unusual Parent | production | 2026-09-18 |
| sigma | Network Communication Initiated To Portmap.IO Domain | test | 2024-05-31 |
| sigma | RDP over Reverse SSH Tunnel WFP | test | 2022-09-02 |