Port Forwarding Services
Observable Types: domain
Description
Adversaries may use a port forwarding proxy/tunnel to direct network traffic between systems or act as an intermediary for payload delivery and network communications to a command and control server to avoid direct connections to their infrastructure.
Blocking access to port forwarding services neutralizes multiple classes of malware command-and-control (C2).
Techniques
References
- https://www.crowdstrike.com/en-us/blog/4-common-endpoint-tools-used-to-facilitate-covert-c2/
- https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
- https://www.sophos.com/en-us/blog/rapid-response-the-ngrok-incident-guide