External Proxy (T1090.002) is the sub-technique of Proxy where the intermediary sits outside the victim network. It is a command and control technique for ESXi, Linux, macOS, Network Devices and Windows.
How attackers use it
MITRE says adversaries may use an external proxy as an intermediary to a command and control server, so that victims never connect directly to the adversary's infrastructure. External proxies mask the destination of C2 traffic and are typically built with port redirectors. They may be compromised systems outside the victim environment, or bought infrastructure such as cloud resources and virtual private servers. MITRE notes proxies may be chosen because a connection to them is unlikely to be investigated. The victim talks to the proxy on the internet, and the proxy forwards to the C2 server.
How to detect it
MITRE's strategy (DET0325) looks at outbound behavior:
- Windows: an unusual process such as rundll32, mshta, wscript or a custom payload connecting to external addresses over uncommon ports or with high entropy HTTP and HTTPS.
- Linux: curl, wget, ncat, socat or custom binaries sending outbound traffic to internet proxies, such as VPS or CDN, including persistent beacons.
- macOS: AppleScript or terminal sessions launching curl, nc or ssh toward external IPs rarely used, and LaunchAgents or LaunchDaemons making outbound connections while posing as system services.
- ESXi: scripted forwarding from the shell or guest tools to internet proxies, visible in firewall or shell audit logs as outbound spikes.
- Network devices: NAT or firewall policy changes enabling outbound port forwarding, and log spikes of outbound flows to CDN, VPS or unusual ASNs with few return packets.
How to reduce the risk
MITRE lists Network Intrusion Prevention, using network detection and prevention systems with signatures for specific adversary malware. MITRE cautions that signatures differ across malware families and adversaries change them over time. A narrow egress policy is a practical complement: allow only needed destinations, and review new ones.
Quick check
What kinds of infrastructure does MITRE say may serve as an external proxy?
Compromised systems outside the victim environment, and purchased infrastructure such as cloud resources or virtual private servers.
Sources
- MITRE ATT&CK, T1090.002 External Proxy: https://attack.mitre.org/techniques/T1090/002/
