Proxy detection rulesT1090

Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.

windows · network_connection

Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.

linux · network_connection

Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors

linux · network_connection

Detects an executable initiating a network connection to "ngrok" tunneling domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.

windows · network_connection

Detects DNS queries to an ".onion" address related to Tor routing networks

windows · dns_query

Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass)

windows · process_creation

Detects usage of the Sharp Chisel via the commandline arguments

windows · process_creation

Detects the execution of the "curl.exe" command, referencing "SOCKS" and ".onion" domains, which could be indicative of Kalambur backdoor activity.

windows · process_creation

Indicates sign-in from a malicious IP address based on high failure rates.

azure

Indicates sign-in from a malicious IP address known to be malicious at time of sign-in.

azure

Detects cases in which ngrok, a reverse proxy tool, forwards events to the local RDP port, which could be a sign of malicious behaviour

windows

Detects instances where an HTTPPROXY service on an OpenCanary node has had an attempt to proxy another page.

opencanary · application

Detects usage of the Chisel tunneling tool via the commandline arguments

windows · process_creation

Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or firewall to the Internet.

windows · process_creation

Detects the use of NPS, a port forwarding and intranet penetration proxy server

windows · process_creation

Detects the use of IOX - a tool for port forwarding and intranet proxy purposes

windows · process_creation

Detects DNS resolution of an .onion address related to Tor routing networks

windows

Detects svchost hosting RDP termsvcs communicating with the loopback address

windows

Detects the execution of netsh to configure a port forwarding of port 3389 (RDP) rule

windows · process_creation

Detects the execution of a renamed "cloudflared" binary.

windows · process_creation

Indicates sign-ins from IP addresses infected with malware that is known to actively communicate with a bot server.

azure

Detects the use of Tor or Tor-Browser to connect to onion routing networks

windows · process_creation

Detects the execution of the "cloudflared" binary from a non standard location.

windows · process_creation

Detects creation of an ad-hoc Cloudflare Quick Tunnel, which can be used to tunnel local services such as HTTP, RDP, SSH and SMB. The free TryCloudflare Quick Tunnel will generate a random subdomain on trycloudflare[.]com, following a call to api[.]trycloudflare[.]com. The tool has been observed in use by threat groups including Akira ransomware.

windows · process_creation

Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.

windows · process_creation

Detects execution of the "cloudflared" tool to connect back to a tunnel. This was seen used by threat actors to maintain persistence and remote access to compromised networks.

windows · process_creation

Detects an executable accessing the portmap.io domain, which could be a sign of forbidden C2 traffic or data exfiltration by malicious actors

windows · network_connection

Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule

windows · process_creation

Detects the modification of the PortProxy registry key which is used for port forwarding.

windows · registry_event

Detects connections with Azure Front Door (known legitimate service that can be leveraged for C2) that fall outside of known benign behavioral baseline (not using common apps or common azurefd.net endpoints)

windows · network_connection

Detects potentially suspicious execution of the Qemu utility in a Windows environment. Threat actors have leveraged this utility and this technique for achieving network access as reported by Kaspersky.

windows · process_creation

Detects powershell scripts that creates sockets/listeners which could be indicative of tunneling activity

windows · ps_script

Detects setting proxy configuration

linux · process_creation