Protocol Tunneling `T1572`

Tactic: Command & Control

Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet.

Events covered

22 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 3	Network connection
Sysmon	Event ID 12	RegistryEvent (Object create and delete)
Sysmon	Event ID 13	RegistryEvent (Value Set)
Sysmon	Event ID 14	RegistryEvent (Key and Value Rename)
Sysmon	Event ID 17	PipeEvent (Pipe Created)
Sysmon	Event ID 18	PipeEvent (Pipe Connected)
Sysmon	Event ID 22	DNSEvent (DNS query)
Security-Auditing	Event ID 4624	An account was successfully logged on.
Security-Auditing	Event ID 4625	An account failed to log on.
Security-Auditing	Event ID 4688	A new process has been created.
Security-Auditing	Event ID 4698	A scheduled task was created.
Security-Auditing	Event ID 4779	A session was disconnected from a Window Station.
ESF	exec	Process Execution
PowerShell	Event ID 4103	Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104	Creating Scriptblock text (MessageNumber of MessageTotal).
TerminalServices-LocalSessionManager	Event ID 21	Remote Desktop Services: Session logon succeeded.
TerminalServices-LocalSessionManager	Event ID 24	Remote Desktop Services: Session has been disconnected.
TerminalServices-LocalSessionManager	Event ID 25	Remote Desktop Services: Session reconnection succeeded.
TerminalServices-RemoteConnectionManager	Event ID 1149	Remote Desktop Services: User authentication succeeded.
Sysmon-for-Linux	Event ID 1	Process Create
Sysmon-for-Linux	Event ID 3	Network connection

Authoring guide

These 96 rules share fields, values, and exclusions.

Fields filtered most (67 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`CommandLine`	33	`contains` 18, `regex_match` 11, `in` 5, `wildcard` 1	`(?i)(\-\-dns)?((\s+)\|(\=))?((server\=)\|(host\=))?((\d{1,3...`, `(?i)(tcp\s+(139\|445\|3389\|5985\|5986))\|(\.exe\s+\|(authtoken...`, `(?i)\-(L\|R\|N\|D\|C)\|IdentitiesOnly=yes\|StrictHostKeyChecking=no\|ssh`, `http`, `\d{1,5}:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}:\d{1,5}`
`process_name`	30	`eq` 21, `in` 8, `regex_match` 5, `starts_with` 3, `ne` 1	`(?i)ngrok\.exe`, `3proxy`, `chisel`, `proxychains`, `(?i)^ssh\.exe`
`event.type`	26	`eq` 26	`start`, `change`
`process.args`	23	`eq` 17, `in` 7, `starts_with` 7, `contains` 6, `wildcard` 5, `regex_match` 4, `ends_with` 1	`-l`, `--listen`, `--preproxy`, `--proxy`, `--remote`
`EventType`	22	`eq` 12, `in` 10	`exec`, `ProcessRollup2`, `exec_event`, `start`, `connection_attempted`
`EventID`	18	`eq` 17, `in` 1	`1`, `4688`, `4104`, `17`, `18`
`host.os.type`	18	`eq` 17, `in` 1
`Image`	11	`ends_with` 9, `eq` 1, `is_not_null` 1	`\plink.exe`, `\ssh.exe`, `\svchost.exe`, `?:\windows\system32\openssh\ssh.exe`, `\3proxy.exe`
`DestinationHostname`	9	`ends_with` 7, `contains` 2	`.localto.net`, `.localtonet.com`, `tunnel.ap.ngrok.com`, `tunnel.au.ngrok.com`, `tunnel.eu.ngrok.com`
`Initiated`	9	`eq` 9	`true`
`parent_process_name`	6	`in` 5, `eq` 1, `starts_with` 1, `wildcard` 1	`bash`, `csh`, `ash`, `*.sh`, `.`
`OriginalFileName`	5	`eq` 5	`plink`, `cloudflared.exe`, `curl.exe`, `plink.exe`, `vpnbridge*.exe`
`QueryName`	5	`ends_with` 2, `contains` 1, `in` 1, `is_not_null` 1, `regex_match` 1	`.ngrok.com`, `.ngrok.io`, `.devtunnels.ms`, `.v2.argotunnel.com`, `[0-9]{1,5}-[a-za-z0-9+/=]{15,63}\..+`
`Type`	5	`eq` 5
`process.args_count`	5	`ge` 5	`4`, `3`, `6`

Top indicator values (524 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.type`	`eq`	`start` elasticCurl SOCKS Proxy Activity from Unusual Parent elasticCurl SOCKS Proxy Detected via Defend for Containers elasticIPv4/IPv6 Forwarding Activity elasticKubectl Network Configuration Modification elasticLinux SSH X11 Forwarding elasticPotential DNS Tunneling via NsLookup elasticPotential Linux Tunneling and/or Port Forwarding elasticPotential Linux Tunneling and/or Port Forwarding elasticPotential Linux Tunneling and/or Port Forwarding via Command Line elasticPotential Linux Tunneling and/or Port Forwarding via SSH Option elasticPotential Linux Tunneling or Port Forwarding via SSH elasticPotential Linux Tunneling via Cloudflared elasticPotential Network Traffic Tunneling via Proxychains elasticPotential Protocol Tunneling via Chisel Client elasticPotential Protocol Tunneling via Cloudflared +10 more rules	25	1078
`EventType`	`eq`	`exec` elasticCurl SOCKS Proxy Activity from Unusual Parent elasticCurl SOCKS Proxy Detected via Defend for Containers elasticPotential Linux Tunneling and/or Port Forwarding elasticPotential Linux Tunneling or Port Forwarding via SSH elasticPotential Linux Tunneling via Cloudflared elasticPotential Network Traffic Tunneling via Proxychains elasticPotential Protocol Tunneling via Chisel Client elasticTorsocks Execution elasticTunneling and/or Port Forwarding Detected via Defend for Containers	9	576
`EventType`	`in`	`ProcessRollup2` elasticIPv4/IPv6 Forwarding Activity elasticKubectl Network Configuration Modification elasticLinux SSH X11 Forwarding elasticPotential Linux Tunneling and/or Port Forwarding elasticPotential Linux Tunneling and/or Port Forwarding via Command Line elasticPotential Linux Tunneling and/or Port Forwarding via SSH Option elasticPotential Protocol Tunneling via EarthWorm elasticProxyChains Activity elasticSuspicious Utility Launched via ProxyChains	9	117
`EventType`	`in`	`exec` elasticIPv4/IPv6 Forwarding Activity elasticKubectl Network Configuration Modification elasticLinux SSH X11 Forwarding elasticPotential Linux Tunneling and/or Port Forwarding elasticPotential Linux Tunneling and/or Port Forwarding via Command Line elasticPotential Linux Tunneling and/or Port Forwarding via SSH Option elasticPotential Protocol Tunneling via EarthWorm elasticProxyChains Activity elasticSuspicious Utility Launched via ProxyChains	9	201
`EventType`	`in`	`exec_event` elasticIPv4/IPv6 Forwarding Activity elasticKubectl Network Configuration Modification elasticLinux SSH X11 Forwarding elasticPotential Linux Tunneling and/or Port Forwarding elasticPotential Linux Tunneling and/or Port Forwarding via Command Line elasticPotential Linux Tunneling and/or Port Forwarding via SSH Option elasticPotential Protocol Tunneling via EarthWorm elasticProxyChains Activity elasticSuspicious Utility Launched via ProxyChains	9	149
`EventType`	`in`	`start` elasticIPv4/IPv6 Forwarding Activity elasticKubectl Network Configuration Modification elasticLinux SSH X11 Forwarding elasticPotential Linux Tunneling and/or Port Forwarding elasticPotential Linux Tunneling and/or Port Forwarding via Command Line elasticPotential Linux Tunneling and/or Port Forwarding via SSH Option elasticPotential Protocol Tunneling via EarthWorm elasticProxyChains Activity elasticSuspicious Utility Launched via ProxyChains	9	163
`EventType`	`in`	`executed` elasticPotential Linux Tunneling and/or Port Forwarding elasticPotential Linux Tunneling and/or Port Forwarding via Command Line elasticPotential Protocol Tunneling via EarthWorm elasticProxyChains Activity elasticSuspicious Utility Launched via ProxyChains	5	98
`EventType`	`in`	`process_started` elasticPotential Linux Tunneling and/or Port Forwarding elasticPotential Linux Tunneling and/or Port Forwarding via Command Line elasticPotential Protocol Tunneling via EarthWorm elasticProxyChains Activity elasticSuspicious Utility Launched via ProxyChains	5	83
`Initiated`	`eq`	`true` sigmaCommunication To LocaltoNet Tunneling Service Initiated sigmaCommunication To LocaltoNet Tunneling Service Initiated - Linux sigmaNetwork Connection Initiated To BTunnels Domains sigmaNetwork Connection Initiated To Cloudflared Tunnels Domains sigmaNetwork Connection Initiated To DevTunnels Domain sigmaNetwork Connection Initiated To Visual Studio Code Tunnels Domain sigmaProcess Initiated Network Connection To Ngrok Domain sigmaRDP Over Reverse SSH Tunnel sigmaRDP to HTTP or HTTPS Target Ports	9	50
`EventID`	`eq`	`1` splunkngrok Execution - Windows (Sysmon) splunkQEMU Network Tunneling - Windows (Sysmon) splunkScheduled Task with Potential SSH Tunnel - Windows (Sysmon) splunkssh.exe Execution (Sysmon) splunkTunneling Process Created (Sysmon) splunkWindows SoftEther VPN Masquerading as Legitimate Binary	6	241
`EventID`	`eq`	`4688` splunkngrok Execution - Windows (Windows Event Log) splunkQEMU Network Tunneling - Windows (Windows Event Log) splunkScheduled Task with Potential SSH Tunnel - Windows (Windows Event Log) splunkssh.exe Execution (Windows Event Log) splunkTunneling Process Created (Windows Event Log)	5	317
`EventID`	`eq`	`4104` splunkngrok Execution - Windows (PowerShell) splunkQEMU Network Tunneling - Windows (PowerShell) splunkScheduled Task with Potential SSH Tunnel - Windows (PowerShell) splunkTunneling Process Created (PowerShell)	4	269
`parent_process_name`	`in`	`bash` elasticCurl SOCKS Proxy Activity from Unusual Parent elasticKubectl Network Configuration Modification elasticLinux SSH X11 Forwarding elasticPotential Linux Tunneling and/or Port Forwarding elasticPotential Protocol Tunneling via Chisel Client	5	65
`parent_process_name`	`in`	`csh` elasticCurl SOCKS Proxy Activity from Unusual Parent elasticKubectl Network Configuration Modification elasticLinux SSH X11 Forwarding elasticPotential Linux Tunneling and/or Port Forwarding elasticPotential Protocol Tunneling via Chisel Client	5	39
`parent_process_name`	`in`	`dash` elasticCurl SOCKS Proxy Activity from Unusual Parent elasticKubectl Network Configuration Modification elasticLinux SSH X11 Forwarding elasticPotential Linux Tunneling and/or Port Forwarding elasticPotential Protocol Tunneling via Chisel Client	5	42
`parent_process_name`	`in`	`fish` elasticCurl SOCKS Proxy Activity from Unusual Parent elasticKubectl Network Configuration Modification elasticLinux SSH X11 Forwarding elasticPotential Linux Tunneling and/or Port Forwarding elasticPotential Protocol Tunneling via Chisel Client	5	40
`parent_process_name`	`in`	`ksh` elasticCurl SOCKS Proxy Activity from Unusual Parent elasticKubectl Network Configuration Modification elasticLinux SSH X11 Forwarding elasticPotential Linux Tunneling and/or Port Forwarding elasticPotential Protocol Tunneling via Chisel Client	5	40
`parent_process_name`	`in`	`sh` elasticCurl SOCKS Proxy Activity from Unusual Parent elasticKubectl Network Configuration Modification elasticLinux SSH X11 Forwarding elasticPotential Linux Tunneling and/or Port Forwarding elasticPotential Protocol Tunneling via Chisel Client	5	65
`parent_process_name`	`in`	`tcsh` elasticCurl SOCKS Proxy Activity from Unusual Parent elasticKubectl Network Configuration Modification elasticLinux SSH X11 Forwarding elasticPotential Linux Tunneling and/or Port Forwarding elasticPotential Protocol Tunneling via Chisel Client	5	40
`parent_process_name`	`in`	`zsh` elasticCurl SOCKS Proxy Activity from Unusual Parent elasticKubectl Network Configuration Modification elasticLinux SSH X11 Forwarding elasticPotential Linux Tunneling and/or Port Forwarding elasticPotential Protocol Tunneling via Chisel Client	5	63
`CommandLine`	`contains`	`connect=` sigmaPotentially Suspicious Usage Of Qemu elasticPotential Linux Tunneling and/or Port Forwarding elasticPotential Traffic Tunneling using QEMU elasticPotential Traffic Tunneling with QEMU	4	4
`CommandLine`	`contains`	`restrict=off` sigmaPotentially Suspicious Usage Of Qemu elasticPotential Linux Tunneling and/or Port Forwarding elasticPotential Traffic Tunneling using QEMU elasticPotential Traffic Tunneling with QEMU	4	4
`CommandLine`	`contains`	`:3389` sigmaPotential RDP Tunneling Via Plink sigmaPotential RDP Tunneling Via SSH elasticPotential Protocol Tunneling via Legit Utilities	3	4
`CommandLine`	`contains`	`tunnel` elasticPotential Linux Tunneling and/or Port Forwarding via SSH Option elasticPotential Linux Tunneling or Port Forwarding via SSH splunkWindows Potential Cloudflared Tunnel Execution	3	6
`process.args`	`eq`	`-l` elasticPotential Linux Tunneling and/or Port Forwarding elasticPotential Protocol Tunneling via Legit Utilities elasticPotential Protocol Tunneling via Yuze elasticPotential Remote Desktop Tunneling Detected	4	17
`process.args`	`eq`	`-s` elasticPotential Linux Tunneling and/or Port Forwarding elasticPotential Protocol Tunneling via EarthWorm elasticPotential Protocol Tunneling via Yuze elasticTunneling and/or Port Forwarding Detected via Defend for Containers	4	8
`process.args`	`eq`	`tunnel` elasticPotential Linux Tunneling and/or Port Forwarding elasticPotential Linux Tunneling via Cloudflared elasticPotential Protocol Tunneling via Cloudflared elasticPotential Protocol Tunneling via Legit Utilities	4	6
`process.args`	`starts_with`	`-R` elasticPotential Linux Tunneling and/or Port Forwarding elasticPotential Linux Tunneling and/or Port Forwarding elasticPotential SSH Reverse Port Forwarding elasticTunneling and/or Port Forwarding Detected via Defend for Containers	4	4
`process.args_count`	`ge`	`4` elasticPotential Linux Tunneling and/or Port Forwarding elasticPotential Linux Tunneling and/or Port Forwarding elasticPotential Linux Tunneling or Port Forwarding via SSH elasticPotential Protocol Tunneling via Chisel Client	4	8
`CommandLine`	`in`	`http` splunkLinux Ngrok Reverse Proxy Usage splunkWindows Ngrok Reverse Proxy Usage splunkWindows SSH Proxy Command	3	3

Exclusions (220 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`Image`	`in`	`/usr/bin/podman` elasticPotential Linux Tunneling and/or Port Forwarding elasticPotential Linux Tunneling via Cloudflared	2
`ParentCommandLine`	`eq`	`runc init` elasticPotential Linux Tunneling and/or Port Forwarding elasticPotential Linux Tunneling via Cloudflared	2
`ParentImage`	`wildcard`	`/home/linuxbrew/.linuxbrew/caskroom/codex/*/codex-x86_64-unknown-linux-musl` elasticPotential Linux Tunneling and/or Port Forwarding elasticPotential Linux Tunneling or Port Forwarding via SSH	2
`dest_ip`	`cidr_match`	`10.0.0.0/8` kustoUbiquiti - Connection to known malicious IP or C2 kustoUbiquiti - Large ICMP to external server	2
`dest_ip`	`cidr_match`	`127.0.0.0/8` kustoUbiquiti - Connection to known malicious IP or C2 kustoUbiquiti - Large ICMP to external server	2
`dest_ip`	`cidr_match`	`169.254.0.0/16` kustoUbiquiti - Connection to known malicious IP or C2 kustoUbiquiti - Large ICMP to external server	2
`dest_ip`	`cidr_match`	`172.16.0.0/12` kustoUbiquiti - Connection to known malicious IP or C2 kustoUbiquiti - Large ICMP to external server	2
`dest_ip`	`cidr_match`	`192.168.0.0/16` kustoUbiquiti - Connection to known malicious IP or C2 kustoUbiquiti - Large ICMP to external server	2
`dest_ip`	`in`	`10.0.0.0/8` elasticIPSEC NAT Traversal Port Activity elasticPotential ICMP Tunneling Activity to the Internet	2
`dest_ip`	`in`	`100.64.0.0/10` elasticIPSEC NAT Traversal Port Activity elasticPotential ICMP Tunneling Activity to the Internet	2
`dest_ip`	`in`	`127.0.0.0/8` elasticIPSEC NAT Traversal Port Activity elasticPotential ICMP Tunneling Activity to the Internet	2
`dest_ip`	`in`	`169.254.0.0/16` elasticIPSEC NAT Traversal Port Activity elasticPotential ICMP Tunneling Activity to the Internet	2
`dest_ip`	`in`	`172.16.0.0/12` elasticIPSEC NAT Traversal Port Activity elasticPotential ICMP Tunneling Activity to the Internet	2
`dest_ip`	`in`	`192.0.0.0/24` elasticIPSEC NAT Traversal Port Activity elasticPotential ICMP Tunneling Activity to the Internet	2
`dest_ip`	`in`	`192.0.0.0/29` elasticIPSEC NAT Traversal Port Activity elasticPotential ICMP Tunneling Activity to the Internet	2

Protocol Tunneling `T1572`

Events covered

Authoring guide

Fields filtered most (67 distinct)

Top indicator values (524 distinct)

Exclusions (220 distinct)

Rules under this technique

Sigma 27 rules

Elastic 33 rules

Splunk 26 rules

Kusto 10 rules

Protocol Tunneling T1572

Events covered

Authoring guide

Fields filtered most (67 distinct)

Top indicator values (524 distinct)

Exclusions (220 distinct)

Rules under this technique

Sigma 27 rules

Elastic 33 rules

Splunk 26 rules

Kusto 10 rules

Protocol Tunneling `T1572`