Esc
Multi-hop Proxy - T1090.003
(ATT&CK® Technique)
Definition
Adversaries may chain together multiple proxies to disguise the source of malicious traffic. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source.
D3FEND Inferred Relationships
Browse the D3FEND knowledge graph by clicking on the nodes below.
graph LR; T1090003["Multi-hop Proxy"] --> |produces| OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; class T1090003 OffensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click OutboundInternetNetworkTraffic href "/dao/artifact/d3f:OutboundInternetNetworkTraffic"; click T1090003 href "/offensive-technique/attack/T1090.003/"; click OutboundInternetNetworkTraffic href "/dao/artifact/d3f:OutboundInternetNetworkTraffic"; NetworkTrafficCommunityDeviation["Network Traffic Community Deviation"] --> | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; NetworkTrafficCommunityDeviation["Network Traffic Community Deviation"] -.-> | may-detect | T1090003["Multi-hop Proxy"] ; class NetworkTrafficCommunityDeviation DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click NetworkTrafficCommunityDeviation href "/technique/d3f:NetworkTrafficCommunityDeviation"; RelayPatternAnalysis["Relay Pattern Analysis"] --> | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; RelayPatternAnalysis["Relay Pattern Analysis"] -.-> | may-detect | T1090003["Multi-hop Proxy"] ; class RelayPatternAnalysis DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click RelayPatternAnalysis href "/technique/d3f:RelayPatternAnalysis"; RemoteTerminalSessionDetection["Remote Terminal Session Detection"] --> | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; RemoteTerminalSessionDetection["Remote Terminal Session Detection"] -.-> | may-detect | T1090003["Multi-hop Proxy"] ; class RemoteTerminalSessionDetection DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click RemoteTerminalSessionDetection href "/technique/d3f:RemoteTerminalSessionDetection"; NetworkTrafficSignatureAnalysis["Network Traffic Signature Analysis"] --> | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; NetworkTrafficSignatureAnalysis["Network Traffic Signature Analysis"] -.-> | may-detect | T1090003["Multi-hop Proxy"] ; class NetworkTrafficSignatureAnalysis DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click NetworkTrafficSignatureAnalysis href "/technique/d3f:NetworkTrafficSignatureAnalysis"; ProtocolMetadataAnomalyDetection["Protocol Metadata Anomaly Detection"] --> | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; ProtocolMetadataAnomalyDetection["Protocol Metadata Anomaly Detection"] -.-> | may-detect | T1090003["Multi-hop Proxy"] ; class ProtocolMetadataAnomalyDetection DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click ProtocolMetadataAnomalyDetection href "/technique/d3f:ProtocolMetadataAnomalyDetection"; UserGeolocationLogonPatternAnalysis["User Geolocation Logon Pattern Analysis"] --> | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; UserGeolocationLogonPatternAnalysis["User Geolocation Logon Pattern Analysis"] -.-> | may-detect | T1090003["Multi-hop Proxy"] ; class UserGeolocationLogonPatternAnalysis DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click UserGeolocationLogonPatternAnalysis href "/technique/d3f:UserGeolocationLogonPatternAnalysis"; PerHostDownload-UploadRatioAnalysis["Per Host Download-Upload Ratio Analysis"] --> | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; PerHostDownload-UploadRatioAnalysis["Per Host Download-Upload Ratio Analysis"] -.-> | may-detect | T1090003["Multi-hop Proxy"] ; class PerHostDownload-UploadRatioAnalysis DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click PerHostDownload-UploadRatioAnalysis href "/technique/d3f:PerHostDownload-UploadRatioAnalysis"; Client-serverPayloadProfiling["Client-server Payload Profiling"] --> | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; Client-serverPayloadProfiling["Client-server Payload Profiling"] -.-> | may-detect | T1090003["Multi-hop Proxy"] ; class Client-serverPayloadProfiling DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click Client-serverPayloadProfiling href "/technique/d3f:Client-serverPayloadProfiling"; NetworkTrafficFiltering["Network Traffic Filtering"] --> | filters | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; NetworkTrafficFiltering["Network Traffic Filtering"] -.-> | may-isolate | T1090003["Multi-hop Proxy"] ; class NetworkTrafficFiltering DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click NetworkTrafficFiltering href "/technique/d3f:NetworkTrafficFiltering"; OutboundTrafficFiltering["Outbound Traffic Filtering"] --> | filters | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; OutboundTrafficFiltering["Outbound Traffic Filtering"] -.-> | may-isolate | T1090003["Multi-hop Proxy"] ; class OutboundTrafficFiltering DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click OutboundTrafficFiltering href "/technique/d3f:OutboundTrafficFiltering";