Procedure examples

BRICKSTORM has utilized a SOCKS proxy to tunnel access within the victim network and exfiltrate files from internal shares, code repositories, and other endpoints. BRICKSTORM has also leveraged Yamux for combining multiple concurrent logical streams over a single a socket.

reGeorg can tunnel TCP sessions including RDP, SSH, and SMB through HTTP.

FLIPSIDE uses RDP to tunnel traffic from a victim environment.

Uroburos has the ability to communicate over custom communications methodologies that ride over common network protocols including raw TCP and UDP sockets, HTTP, SMTP, and DNS.

HiddenFace can hide its IP lookup by using DNS over HTTPS (DoH) for C2.

Cobalt Strike uses a custom command and control protocol that is encapsulated in HTTP, HTTPS, or DNS. In addition, it conducts peer-to-peer communication over Windows named pipes encapsulated in the SMB protocol. All protocols use their standard assigned ports.

Milan can use a custom protocol tunneled through DNS or HTTP.

Cyclops Blink can use DNS over HTTPS (DoH) to resolve C2 nodes.

Neo-reGeorg can tunnel data in and out of targeted networks.

FunnyDream can connect to HTTP proxies via TCP to create a tunnel to C2.

SPAWNCHIMERA has created SSH tunnels to facilitate C2 communications.

Heyoka Backdoor can use spoofed DNS requests to create a bidirectional tunnel between a compromised host and its C2 servers.

LunarWeb can run a custom binary protocol under HTTPS for C2.

Industroyer attempts to perform an HTTP CONNECT via an internal proxy to establish a tunnel.

Kevin can use a custom protocol tunneled through DNS or HTTP.

The QakBot proxy module can encapsulate SOCKS5 protocol within its own proxy protocol.

ngrok can tunnel RDP and other services securely over internet connections.

FRP can tunnel SSH and Unix Domain Socket communications over TCP between external nodes and exposed resources behind firewalls or NAT.

Brute Ratel C4 can use DNS over HTTPS for C2.

Mythic can use SOCKS proxies to tunnel traffic through another protocol.

Duqu uses a custom command and control protocol that communicates over commonly used ports, and is frequently encapsulated by application layer protocols.