Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1090.001_internal-proxy
Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment.
Passed 18 of 22 test cases with the skill, and 11 of 22 without it.
and 8 more in the full report
8 fixed10 passed either way3 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 8 test cases the skill fixed. Same model, same prompt, with and without the skill.
When defining the platform scope for internal proxying assessments (T1090.001), team leads frequently limit checks to standard desktop OS options like Windows, Linux, and macOS. Which two additional infrastructure platforms are explicitly listed in the scope of this sub-technique?
| Checked | Without skill | With skill |
|---|---|---|
| Includes Network Devices in the listed platforms. | Passed | Passed |
| Includes ESXi in the listed platforms. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1090
Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use internal proxies to manage command and control communications inside a compromised environment, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between infected systems to avoid suspicion. Internal proxy connections may use common peer-to-peer (p2p) networking protocols, such as SMB, to better blend in with the environment.
By using a compromised internal system as a proxy, adversaries may conceal the true destination of C2 traffic while reducing the need for numerous connections to external systems.
Platforms: Linux, Network Devices, Windows, macOS, ESXi
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Enable traffic redirection.
Note that this test may conflict with pre-existing system configuration.
Supported Platforms: linux, macos
test cases passed, vs 11 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.