1. Home
  2. ATT&CK Techniques
  3. T1572 Protocol Tunneling

T1572 Protocol Tunneling

Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet.

There are various means to encapsulate a protocol within another protocol. For example, adversaries may perform SSH tunneling (also known as SSH port forwarding), which involves forwarding arbitrary data over an encrypted SSH tunnel.(Citation: SSH Tunneling)(Citation: Sygnia Abyss Locker 2025)

Protocol Tunneling may also be abused by adversaries during Dynamic Resolution. Known as DNS over HTTPS (DoH), queries to resolve C2 infrastructure may be encapsulated within encrypted HTTPS packets.(Citation: BleepingComp Godlua JUL19)

Adversaries may also leverage Protocol Tunneling in conjunction with Proxy and/or Protocol or Service Impersonation to further conceal C2 communications and infrastructure.

View in MITRE ATT&CK®

CIS Controls Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
CIS-13.10 Perform Application Layer Filtering mitigates T1572 Protocol Tunneling
Comments
Application-aware filtering can identify and restrict unauthorized tunneling through otherwise permitted application protocols and services.
References
  1. https://cas.docs.cisecurity.org/en/latest/source/Controls13/#1310-perform-application-layer-filtering
CIS-13.8 Deploy a Network Intrusion Prevention Solution mitigates T1572 Protocol Tunneling
Comments
Network intrusion prevention solutions can use signatures for known adversary malware and tunneling traffic to block identifiable protocol-tunneling activity at monitored network boundaries.
References
  1. https://cas.docs.cisecurity.org/en/latest/source/Controls13/#138-deploy-a-network-intrusion-prevention-solutions
CIS-13.4 Perform Traffic Filtering Between Network Segments mitigates T1572 Protocol Tunneling
Comments
Filter network traffic between segments to untrusted, unauthorized, or known malicious destinations and restrict protocols that can be abused to tunnel communications across network boundaries.
References
  1. https://cas.docs.cisecurity.org/en/latest/source/Controls13/#134-perform-traffic-filtering-between-network-segments
CIS-9.2 Use DNS Filtering Services mitigates T1572 Protocol Tunneling
Comments
DNS filtering can block tunnels that depend on resolving known malicious domains, including some DNS and web-based tunnels. Tunnels using direct IP addresses, trusted domains, or infrastructure not yet classified as malicious may still succeed.
References
    CIS-4.9 Configure Trusted DNS Servers on Enterprise Assets mitigates T1572 Protocol Tunneling
    Comments
    DNS can be used to tunnel command-and-control traffic or other protocols. Enforcing trusted resolvers and preventing direct DNS communication can disrupt conventional DNS tunneling,
    References
      CIS-4.6 Securely Manage Enterprise Assets and Software mitigates T1572 Protocol Tunneling
      Comments
      Securely configuring SSH, VPN, and administrative tools can disable unnecessary port forwarding and tunneling functions. The safeguard does not prevent tunneling through an otherwise approved secure protocol when that capability is operationally required.
      References
        CIS-4.5 Implement and Manage a Firewall on End-User Devices mitigates T1572 Protocol Tunneling
        Comments
        Limiting approved ports, protocols, services, and destinations can prevent many unauthorized tunnels. Tunnels encapsulated within an approved HTTPS, DNS, or SSH connection may still succeed.
        References
          CIS-4.4 Implement and Manage a Firewall on Servers mitigates T1572 Protocol Tunneling
          Comments
          Restricting permitted ports, protocols, and destinations can impede protocol tunneling from compromised servers. Tunnels carried inside an explicitly allowed protocol may still bypass simple port-based filtering.
          References

            VERIS Mappings

            Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
            action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1572 Protocol Tunneling
            action.hacking.vector.Other network service Network service that is not remote access or a web application. related-to T1572 Protocol Tunneling
            action.malware.variety.Backdoor or C2 Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. related-to T1572 Protocol Tunneling
            action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1572 Protocol Tunneling

            GCP Mappings

            Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
            cloud_ngfw Cloud Next-Generation Firewall (NGFW)_ technique_scores T1572 Protocol Tunneling
            Comments
            Cloud NGFW can allow or deny traffic based on the traffic's protocol, destination ports, sources, and destinations. This functionality can be used to block traffic from known bad IP addresses and domains which could protect against protocol tunneling by adversaries. This mapping is given a score of partial because it only blocks known bad IP addresses and domains and does not protect against unknown ones.
            References
            1. https://cloud.google.com/firewalls

            AWS Mappings

            Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
            aws_network_firewall AWS Network Firewall technique_scores T1572 Protocol Tunneling
            Comments
            AWS Network Firewall has the ability to pass, drop, or alert on traffic based on the network protocol as well as perform deep packet inspection on the payload. This functionality can be used to block traffic from known bad IP addresses and domains which could protect against protocol tunneling by adversaries. This mapping is given a score of partial because it only blocks known bad IP addresses and domains and does not protect against unknown ones.
            References
            1. https://docs.aws.amazon.com/network-firewall/latest/developerguide/what-is-aws-network-firewall.html