TA0011 · COMMAND AND CONTROL
Protocol Tunneling
Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems.
Detect it with
Monitoring for systems listening and/or establishing external connections using ports/protocols commonly associated with tunneling, such as SSH (port 22). Also monitor for processes commonly associated with tunneling, such as Plink and the OpenSSH client.
Why it matters on shift
Protocol Tunneling is one of the concrete ways adversaries achieve command and control. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After command and control, the next tactic is usually Exfiltration. Search your telemetry for the transition before closing the ticket.
Kill-chain context