T1572: Protocol Tunneling

Command And Control Intelligence Profile

AI Answer

Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to (Source: MITRE ATT&CK T1572)

Confidence: 0.9 · Source: MITRE ATT&CK · Requires review: yes · Freshness: 2026-09-07

ATT&CK Mapping

Field	Value
Technique ID	T1572
Name	Protocol Tunneling
Tactic	Command and Control (command-and-control)
Platforms	ESXi, Linux, macOS, Windows
Sub-technique	No

Why it matters

In the OpenTrojan knowledge graph, Protocol Tunneling (T1572) is one of the highest-connectivity ATT&CK techniques: 42 MITRE STIX relationships reference this technique; 15 threat groups observed using it; 21 software families associated; 6 campaigns associated. These counts are derived from MITRE ATT&CK STIX relationships and are not an estimate of exploitation volume.

How attackers use it

Behavior described below is from the MITRE ATT&CK canonical definition (source: https://attack.mitre.org/techniques/T1572). Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet. There are various means to encapsulate a protocol within another protocol. For example, adversaries may perform SSH tunneling (also known as SSH port forwarding), which involves forwarding arbitrary data over an encrypted SSH tunnel. Protocol Tunneling may also be abused by adversaries during Dynamic Resolution. Known as DNS over HTTPS (DoH), queries to resolve C2 infrastructure may be encapsulated within encrypted HTTPS packets. Adversaries may also leverage Protocol Tunneling in conjunction with Proxy and/or Protocol or Service Impersonation to further conceal C2 communications and infrastructure.

Detection

Not available — MITRE ATT&CK does not currently publish a structured detection strategy for this technique in the ingested dataset.

Mitigation

Use intrusion detection signatures to block traffic at network boundaries.

Mitigation guidance is from the MITRE ATT&CK course-of-action associated with this technique.

BRICKSTORM
reGeorg
FLIPSIDE
Uroburos
HiddenFace
Cobalt Strike
Milan
Cyclops Blink
Neo-reGeorg
FunnyDream
SPAWNCHIMERA
Heyoka Backdoor

Software associations are from MITRE ATT&CK STIX relationships (observed usage, not attribution).

Salt Typhoon
FIN6
FIN7
Mustang Panda
Scattered Spider
OilRig
Leviathan
Cinnamon Tempest
Chimera
Ember Bear
Fox Kitten
Cobalt Group

Group associations are from MITRE ATT&CK STIX relationships.

SharePoint ToolShell Exploitation
Cutting Edge
C0032
C0027
2022 Ukraine Electric Power Attack
CostaRicto

Campaign associations are from MITRE ATT&CK STIX relationships.

References

Source Attribution

Source: MITRE ATT&CK (MITRE ATT&CK) · Confidence: 0.9 · Reviewed: OpenTrojan - Human Review

Start Investigation

Move from reading to investigating T1572 Protocol Tunneling. The workspace is a structured analysis surface — not a chat — organised as:

Question — what do you need to know about T1572 Protocol Tunneling?
Evidence — assertions mapped to verifiable references.
Timeline — events in chronological order.
Related Entities — CVE, threat actor, campaign, malware links.
Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
Notes — your own observations and working hypotheses.

AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.

Start Investigation Open Workspace