Detect External Proxy in Microsoft Sentinel
Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Tools like HTRAN, ZXProxy, and ZXPortMap enable traffic redirection through proxies or port redirection. External connection proxies mask the destination of C2 traffic and are typically implemented with port redirectors. Compromised systems outside the victim environment, cloud-based resources, or VPS infrastructure may be used. Victim systems communicate directly with the external proxy, which then forwards traffic to the actual C2 server.
MITRE ATT&CK
- Tactic
- Command and Control
- Technique
- T1090 Proxy
- Sub-technique
- T1090.002 External Proxy
- Canonical reference
- https://attack.mitre.org/techniques/T1090/002/
KQL Detection Query
let KnownProxyTools = dynamic([
"htran", "zxproxy", "zxportmap", "proxychains", "revsocks", "chisel",
"frp", "frpc", "frps", "ncat", "socat", "3proxy", "shadowsocks",
"ss-local", "privoxy", "stunnel", "iodine", "dns2tcp", "ptunnel"
]);
let SuspiciousProxyArgs = dynamic([
"-socks", "-socks4", "-socks5", "-proxy", "socks5://", "socks4://",
"-L ", "-R ", "-D ", "-w ", "--proxy", "-x ", "connect-proxy",
"-N -D", "-fN -D", "-nNT -D"
]);
let SuspiciousPorts = dynamic([1080, 3128, 8080, 8888, 9050, 9051, 4444, 1337, 31337, 8443, 4443]);
// Branch 1: Known proxy tool execution
let ProxyProcesses = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName has_any (KnownProxyTools)
or ProcessCommandLine has_any (KnownProxyTools)
or ProcessCommandLine has_any (SuspiciousProxyArgs)
| extend DetectionReason = "Known proxy tool or argument detected"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionReason;
// Branch 2: Network connections to high proxy ports from unusual processes
let ProxyNetworkConns = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemotePort in (SuspiciousPorts)
| where RemoteIPType == "Public"
| where not (InitiatingProcessFileName in~ ("chrome.exe", "firefox.exe", "msedge.exe",
"iexplore.exe", "opera.exe", "brave.exe", "curl.exe", "wget.exe"))
| extend DetectionReason = strcat("Outbound connection to proxy port ", RemotePort, " from ", InitiatingProcessFileName)
| project Timestamp, DeviceName,
AccountName = InitiatingProcessAccountName,
FileName = InitiatingProcessFileName,
ProcessCommandLine = InitiatingProcessCommandLine,
InitiatingProcessFileName = InitiatingProcessParentFileName,
InitiatingProcessCommandLine = "",
DetectionReason;
// Branch 3: SSH used as SOCKS proxy (-D flag dynamic port forwarding)
let SSHSocksProxy = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("ssh.exe", "ssh", "plink.exe")
| where ProcessCommandLine matches regex @"-[fNnqT]*D\s+\d+"
or ProcessCommandLine has "-D " or ProcessCommandLine has "-nNT"
| extend DetectionReason = "SSH dynamic port forwarding (SOCKS proxy) detected"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionReason;
// Combine all branches
union ProxyProcesses, ProxyNetworkConns, SSHSocksProxy
| sort by Timestamp descDetects external proxy usage for C2 communication via three complementary approaches: (1) execution of known proxy tools (HTRAN, chisel, frp, socat, etc.) or processes with proxy-related command-line arguments; (2) outbound network connections to common proxy ports (1080, 3128, 8080, 9050, etc.) from non-browser processes; (3) SSH being used for dynamic port forwarding (SOCKS proxy via -D flag). Uses DeviceProcessEvents and DeviceNetworkEvents tables from Microsoft Defender for Endpoint.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate SSH tunneling by administrators for database or management access via -D dynamic port forwarding
- Security researchers or penetration testers using proxy tools in authorized assessments
- Corporate proxy infrastructure where internal tools connect to a central proxy server on port 3128 or 8080
- VPN clients or privacy tools (Tor Browser, Shadowsocks) used legitimately on endpoints where these are permitted
- Development environments using tools like socat or chisel for local port forwarding during application testing
Other platforms for T1090.002
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1SOCKS5 Proxy via SSH Dynamic Port Forwarding
Expected signal: Sysmon for Linux or auditd: Process creation for ssh with command line containing '-D 1080'. Network connection event showing TCP bind on 127.0.0.1:1080. If Sysmon EID 3 is available, outbound TCP connection to the target SSH server on port 2222.
- Test 2TCP Port Forwarding via Chisel Proxy Tool
Expected signal: Sysmon Event ID 1: Process Create for chisel.exe with command line containing 'client' and 'socks'. Sysmon Event ID 3: Network connection from chisel.exe to 127.0.0.1:8080. Sysmon Event ID 11: File creation of chisel.exe in %TEMP%. Security Event ID 4688 (if command line auditing enabled).
- Test 3HTRAN Port Redirector Execution
Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing 'htran'. If actual HTRAN binary is used in an authorized test environment: direct process creation event with '-listen' argument and IP:port parameters. Security Event ID 4688 with htran.exe image path.
- Test 4FRP (Fast Reverse Proxy) Client Configuration and Execution
Expected signal: Sysmon Event ID 11: File creation of frpc.ini in %TEMP% with content showing server_addr, server_port, and plugin=socks5. Sysmon Event ID 1: PowerShell process creation with command containing 'frpc.ini'. The configuration file content reveals the external C2 relay address (192.0.2.1).
- Test 5SOCKS Proxy via Netcat-style Listener (socat)
Expected signal: Linux auditd/Sysmon for Linux: Process creation for socat with arguments 'TCP4-LISTEN:1080' and 'TCP4:192.0.2.1:4444'. Network socket creation binding to local port 1080. If Sysmon EID 3 available: outbound connection attempt to 192.0.2.1:4444.
References (12)
- https://attack.mitre.org/techniques/T1090/002/
- https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
- http://blog.trendmicro.com/trendlabs-security-intelligence/in-depth-look-apt-attack-tools-of-the-trade/
- https://www.mandiant.com/resources/blog/apt29-eye-spy-email
- https://github.com/jpillora/chisel
- https://github.com/fatedier/frp
- https://www.varonis.com/blog/what-is-htran
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-277a
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1090.002/T1090.002.md
- https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicenetworkevents-table
- https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/CommonStatsFunctions
Unlock Pro Content
Get the full detection package for T1090.002 including response playbook, investigation guide, and atomic red team tests.