T1572: Protocol Tunneling

Technique
COMPLETED
COMPLETED
RUNTIME
RUNTIME
TOTAL DATA SCANNED
TOTAL DATA SCANNED
LOGS ANALYZED
LOGS ANALYZED
HUNTS CONDUCTED
HUNTS CONDUCTED

Investigation confirmed an active breach: reGeorg web shell tunneling artifacts are present and functional on two internet-facing production DMZ servers (DMZ-WEBA-PRD and DMZ-WEBB-PRD), with unidentified internal hosts actively sending tunneled traffic through them. Additionally, four DNS-over-HTTPS leads across two unmanaged network segments remain inconclusive due to complete absence of endpoint telemetry. SSH port forwarding was attributed to legitimate developer tooling.

  • Immediately isolate DMZ-WEBA-PRD and DMZ-WEBB-PRD, collect /tcp.php and all adjacent PHP files from C:\inetpub\wwwroot\ for forensic analysis, identify the unmapped internal source devices at 10.50.25.2 and 10.50.25.253 in the DMZ network segment, and initiate incident response for confirmed reGeorg web shell tunneling on internet-facing production infrastructure

  • Onboard the 10.70.52.0/24, 10.80.70.0/24, and 10.90.0.0/16 network segments into CrowdStrike and the enterprise asset management system — all four DoH hunt leads were inconclusive solely because no endpoint telemetry exists for these subnets, leaving an unknown number of devices completely unmonitored

  • Enable and forward DNS client diagnostic logging (Microsoft-Windows-DNS-Client), DNS server audit logs, and Sysmon process creation events (Event ID 1) to Microsoft Sentinel — the DNS tunneling hunt returned zero results across all 7 queries, meaning this entire attack vector is currently invisible

  • Baseline VS Code Remote SSH extension patterns (Code.exe → cmd.exe → ssh.exe -D targeting internal development servers) to reduce false positives in future SSH tunnel hunts

Users
abc7367abc6105adm-svc01svc-logtransfer
Hosts
HOST-1197.thisisarealcompany.comHOST-4821.thisisarealcompany.comDMZ-WEBA-PRD.thisisarealcompany.comDMZ-WEBB-PRD.thisisarealcompany.comDMZ-WEBA-DEVDMZ-WEBAG-QASRV-APPDEV-01
IPs
10.43.2.10310.43.3.16910.43.3.21610.43.3.21710.46.2.1110.46.2.11710.50.25.210.50.25.25310.60.2.310.70.52.15110.70.52.15310.71.32.15010.71.32.15410.80.70.3510.80.70.4810.80.70.5110.80.70.10110.80.70.10510.80.70.10910.80.70.11010.80.70.11210.80.70.12310.80.70.24610.80.70.24810.90.4.10610.90.4.16110.90.4.16210.90.4.22210.90.5.10710.90.5.152203.0.113.7203.0.113.24203.0.113.159203.0.113.160127.0.0.11.1.1.11.0.0.18.8.8.88.8.4.49.9.9.9149.112.112.112208.67.222.222208.67.220.22094.140.14.1494.140.15.1576.76.2.076.76.10.0

1

Urgent
14%

4

Notable
57%

2

Informational
29%
Urgent
Critical Asset
Hunt 5
Feb 10 – Feb 12HTTP Tunneling via Web Shells (reGeorg Pattern)
Notable
Critical Asset
Hunt 5
Feb 12HTTP Tunneling via Web Shells (reGeorg Pattern)
Notable
Critical Asset
Hunt 5
Feb 10 – Feb 12HTTP Tunneling via Web Shells (reGeorg Pattern)
Notable
Hunt 4
Feb 2 – Feb 4Unauthorized DNS over HTTPS (DoH) Clients
Notable
Hunt 4
Feb 2 – Feb 3Unauthorized DNS over HTTPS (DoH) Clients
Informational
Critical Asset
Hunt 1
Mar 2SSH and Plink Port Forwarding Execution
Informational
Critical Asset
Hunt 1
Feb 4SSH and Plink Port Forwarding Execution
Hunt 1
SSH and Plink Port Forwarding Execution
Adversaries and insiders are utilizing legitimate SSH clients (ssh.exe, plink.exe) with port forwarding arguments (-L, -R, -D) to create encrypted tunnels, encapsulating prohibited protocols like RDP or SMB to bypass network firewalls and mask lateral movement or data exfiltration.
0
0
2
Hunt 2
Suspicious Tunneling Utility Execution
Adversaries are executing standalone tunneling utilities (specifically Ngrok, FRP, Chisel, NPS, or SSHMinion) on endpoints to encapsulate malicious traffic within legitimate protocols, thereby bypassing network firewalls and exposing internal resources to C2 servers.
0
0
0
Hunt 3
DNS Tunneling Traffic Analysis
Adversaries, potentially using tools like Iodine or Heyoka, are tunneling Command and Control (C2) traffic through the standard DNS protocol (Port 53) to bypass network firewalls. This activity will manifest as an anomalous volume of DNS queries to a single, low-reputation domain, characterized by long, high-entropy subdomains (encoding upstream data) and large TXT/NULL record responses (encoding downstream data).
0
0
0
Hunt 4
Unauthorized DNS over HTTPS (DoH) Clients
Adversaries and malware are utilizing non-browser processes to establish direct HTTPS connections to public DNS-over-HTTPS (DoH) resolvers (e.g., Cloudflare, Google), thereby bypassing internal DNS logging, filtering, and sinkholing mechanisms to resolve Command and Control (C2) infrastructure.
0
2
0
Hunt 5
HTTP Tunneling via Web Shells (reGeorg Pattern)
Adversaries are tunneling arbitrary network traffic through a compromised web server using web shells (e.g., reGeorg, Neo-reGeorg), which can be detected by identifying an anomalous volume of HTTP POST requests to a single web script resource.
1
2
0