Internal Proxy (T1090.001) is the sub-technique of Proxy where one compromised system inside a network relays traffic for others. It is a command and control technique for ESXi, Linux, macOS, Network Devices and Windows.
How attackers use it
MITRE says adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Tools for traffic redirection include HTRAN, ZXProxy and ZXPortMap. The reasons given are to manage C2 inside the environment, reduce the number of simultaneous outbound connections, stay resilient if a connection is lost, and ride existing trusted paths between infected systems to avoid suspicion.
Internal proxy connections may use common peer to peer protocols such as SMB to blend in. By using one compromised internal system as the proxy, adversaries hide the true destination of C2 traffic and need fewer connections to external systems. For defenders this means that only one host talks to the outside, which makes egress logs look quiet.
How to detect it
MITRE's strategy (DET0075) covers each platform:
- Windows: an anomalous process such as rundll32, svchost or cmd connecting to internal peer hosts not seen in typical communication baselines, often over SMB, RPC or high ports.
- Linux: socat, ssh, iptables or ncat run from user space or cron jobs to create port forwarding, reverse shells or tunnels between hosts.
- macOS: AppleScript or Automator services launching ssh with local forwarding, socat, or launchctl items that reroute traffic from one Mac to another, and LaunchAgents that keep internal tunnels permanent.
- ESXi: shell execution of nc, socat or perl relaying traffic to other internal hosts, especially when started by unauthorized users or VMs.
- Network devices: internal NAT or proxy rules that redirect traffic between client segments, such as site to site port forwarding.
The east west view matters here. Internal flow data and endpoint connection logs show workstations talking to other workstations, which is normally rare.
How to reduce the risk
MITRE lists Network Intrusion Prevention: use network detection and prevention systems with signatures for specific adversary malware. MITRE cautions that signatures are tool specific and adversaries will change them. Segmenting the network so that workstations cannot reach each other directly removes the peer paths this technique depends on, though MITRE does not list segmentation for this sub-technique.
Check your own environment
- Do workstations need to accept inbound connections from other workstations?
- Do you collect internal flow logs or host firewall logs?
- Who may change NAT and forwarding rules on internal network devices?
On Linux, a read-only list of listening sockets and their owners:
ss -tlnp
Quick check
Why might an internal proxy make egress logs look clean?
Only the proxy host talks to external systems, so the number of outbound connections is small.
Sources
- MITRE ATT&CK, T1090.001 Internal Proxy: https://attack.mitre.org/techniques/T1090/001/
