Detect Multi-hop Proxy in Google Chronicle
Adversaries may chain together multiple proxies to disguise the source of malicious traffic. Techniques include Tor onion routing, ProxyChains, SOCKS proxy chaining, operational relay box (ORB) networks, and peer-to-peer routing to make attribution difficult. Defenders can typically only see the last hop before their network boundary.
MITRE ATT&CK
- Tactic
- Command and Control
- Technique
- T1090 Proxy
- Sub-technique
- T1090.003 Multi-hop Proxy
- Canonical reference
- https://attack.mitre.org/techniques/T1090/003/
YARA-L Detection Query
rule t1090_003_multi_hop_proxy_process_launch {
meta:
author = "Argus Detection Engineering"
description = "Detects T1090.003 - Multi-hop proxy via known proxy tool execution and SSH dynamic forwarding"
mitre_attack_tactic = "Command and Control"
mitre_attack_technique = "T1090.003"
severity = "HIGH"
confidence = "HIGH"
events:
$e.metadata.event_type = "PROCESS_LAUNCH"
(
re.regex($e.target.process.file.full_path, `(?i)(tor\.exe|proxychains|proxifier\.exe|3proxy\.exe|srelay\.exe|microsocks|redsocks|plink\.exe)`)
or re.regex($e.target.process.command_line, `(?i)(proxychains|socks5|socks4a?|tor2web|proxyjump|proxycommand|dynamicforward)`)
or (
re.regex($e.target.process.file.full_path, `(?i)[\\/]ssh(\.exe)?$|plink\.exe$`)
and re.regex($e.target.process.command_line, `(?i)(\s-[DJw]\s|proxyjump|proxycommand)`)
)
)
condition:
$e
}
rule t1090_003_tor_port_network_connection {
meta:
author = "Argus Detection Engineering"
description = "Detects T1090.003 - Outbound network connection to Tor relay ports on public IP addresses"
mitre_attack_tactic = "Command and Control"
mitre_attack_technique = "T1090.003"
severity = "HIGH"
confidence = "HIGH"
events:
$e.metadata.event_type = "NETWORK_CONNECTION"
$e.network.direction = "OUTBOUND"
$e.target.port in (9001, 9030, 9040, 9050, 9051, 9150, 9151)
not net.ip_in_range_cidr($e.target.ip, "10.0.0.0/8")
not net.ip_in_range_cidr($e.target.ip, "172.16.0.0/12")
not net.ip_in_range_cidr($e.target.ip, "192.168.0.0/16")
not net.ip_in_range_cidr($e.target.ip, "127.0.0.0/8")
condition:
$e
}Two complementary Chronicle YARA-L 2.0 rules detecting T1090.003. Rule 1 (t1090_003_multi_hop_proxy_process_launch) fires on PROCESS_LAUNCH UDM events where the target process full path matches known proxy tool filenames or the command line contains SOCKS proxy keywords, Tor-related arguments, SSH dynamic forwarding flags, ProxyJump, or ProxyCommand patterns. Rule 2 (t1090_003_tor_port_network_connection) fires on NETWORK_CONNECTION UDM events that are outbound, target Tor relay ports, and destinate to non-RFC1918 public addresses using Chronicle's built-in net.ip_in_range_cidr function for accurate CIDR exclusion.
Data Sources
Required Tables
False Positives & Tuning
- Authorized red team or penetration testing personnel running Tor, plink, or ProxyChains on Chronicle-enrolled endpoints during documented, scoped engagements
- DevOps or SRE teams establishing SSH dynamic port forwarding (-D) or multi-hop ProxyJump chains to reach services in isolated network segments as part of standard access procedures
- OSINT analysts or threat intelligence researchers using Tor Browser on corporate devices to access dark web resources under an approved, policy-documented research exception
Other platforms for T1090.003
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Launch Tor Process as SOCKS Proxy
Expected signal: Sysmon Event ID 1: Process Create with Image path in %TEMP%\tortest\tor\tor.exe and CommandLine containing --SocksPort 9050. Sysmon Event ID 3: Multiple outbound TCP connections to public IPs on ports 9001 and 9030 (Tor directory and guard connections). Sysmon Event ID 11: File creation events for tor.exe and torrc in non-standard temp path.
- Test 2ProxyChains Multi-hop Configuration and Execution
Expected signal: Linux auditd/syslog: Process creation for proxychains4 with command line referencing the config file. Sysmon for Linux (if deployed) Event ID 1: Process Create for proxychains4 with full command line. Network connection attempts through the configured SOCKS chain. File creation event for /tmp/test_proxychains.conf.
- Test 3SSH Dynamic Port Forwarding (Multi-hop SOCKS Proxy)
Expected signal: Sysmon Event ID 1 (Linux) or Security Event ID 4688 (Windows with OpenSSH): Process Create for ssh with CommandLine containing '-D 1080' or '-J jumphost.example.com'. Sysmon Event ID 3: Outbound TCP connection to 192.0.2.1:22 and jumphost.example.com:22. The -D flag creates a listening socket on local port 1080 visible in netstat/socket monitoring.
- Test 4SOCKS Proxy via Netcat/Ncat Relay Chain Simulation
Expected signal: Sysmon Event ID 1: Multiple ncat.exe or nc.exe process creation events with -l (listen) and -c (command/forward) flags. Sysmon Event ID 3: Network listen and connection events on ports 18080 and 18081. Security Event ID 4688 (if command line auditing enabled): ncat.exe process creation with forwarding arguments.
References (12)
- https://attack.mitre.org/techniques/T1090/003/
- https://en.wikipedia.org/wiki/Onion_routing
- https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-orb-networks
- https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-200a
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-129a
- https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/
- https://www.torproject.org/about/history/
- https://github.com/rofl0r/proxychains-ng
- https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicenetworkevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1090.003/T1090.003.md
Unlock Pro Content
Get the full detection package for T1090.003 including response playbook, investigation guide, and atomic red team tests.