T1572Command and Control
Protocol Tunneling
Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
24 Sigma rules tagged T1572Protocol TunnelingT157224 general rules
- Silence.EDA Detectioncriticaltest
- Communication To LocaltoNet Tunneling Service Initiatedhightest
- Communication To LocaltoNet Tunneling Service Initiated - Linuxhightest
- Communication To Ngrok Tunneling Service - Linuxhightest
- Communication To Ngrok Tunneling Service Initiatedhightest
- Potential RDP Tunneling Via Plinkhightest
- Potential RDP Tunneling Via SSHhightest
- Process Initiated Network Connection To Ngrok Domainhightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Protocol Tunneling
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.