Tunneling

Adversaries are abusing native Windows OpenSSH and Plink binaries to establish unauthorized reverse SSH tunnels, bypassing inbound connectivity controls for C2 and lateral movement.

Adversaries may abuse Cloudflare Tunnel (cloudflared) on Windows systems to proxy command and control traffic or exfiltrate data through Cloudflare's edge, evading direct connection blocking.

The Warlock group utilizes web shells and tunneling to deploy ransomware within compromised environments, impacting victim data confidentiality and availability.

Detection of SSH utilities establishing RDP tunnels, potentially enabling attackers to route network packets to otherwise unreachable destinations, facilitating command and control or lateral movement.

This brief describes the detection of Yuze, an open-source tunneling tool often executed via rundll32 to proxy C2 or pivot traffic within a compromised network.

This brief detects network connection events associated with the Cloudflared tool, used to create tunnels via Cloudflare, potentially for unauthorized access or exfiltration, by establishing outbound connections to Cloudflare Edge Servers.