Skip to content
Threat Feed
Subscribe

Tag

Protocol-Tunneling

2 briefs RSS
medium advisory

IPSEC NAT Traversal Port Activity Used for Command and Control

A detection rule identifies suspicious outbound IPSEC NAT Traversal (NAT-T) tunnels, characterized by UDP traffic where both source and destination ports are 4500, originating from an internal host to an external destination, a technique frequently abused by threat actors to establish covert command and control channels or exfiltrate data while evading network defenses.

command-and-control network vpn exfiltration protocol-tunneling
1r 3t
medium advisory

Cloudflare Tunnel (cloudflared) Abuse for Protocol Tunneling

Adversaries are abusing Cloudflare Tunnel (cloudflared) to create outbound tunnels and proxy command and control traffic, or exfiltrate data, evading direct connection blocking by routing traffic through Cloudflare's edge.

Cloudflare Tunnel command-and-control protocol-tunneling windows
3r 2t 1i