Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1090.002_external-proxy
Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure.
Passed 20 of 25 test cases with the skill, and 15 of 25 without it.
and 3 more in the full report
6 fixed14 passed either way4 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
We are filing an application security advisory for external C2 proxies used to bypass direct network controls. Security analysts often incorrectly tag this under CWE-200 (Information Exposure) or CWE-693 (Protection Mechanism Failure). What is the exact CWE identifier designated for this proxy pattern?
| Checked | Without skill | With skill |
|---|---|---|
| Maps the finding to CWE-300. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1090
Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths to avoid suspicion.
External connection proxies are used to mask the destination of C2 traffic and are typically implemented with port redirectors. Compromised systems outside of the victim environment may be used for these purposes, as well as purchased infrastructure such as cloud-based resources or virtual private servers. Proxies may be chosen based on the low likelihood that a connection to them from a compromised system would be investigated. Victim systems would communicate directly with the external proxy on the Internet and then the proxy would forward communications to the C2 server.
Platforms: ESXi, Linux, Network Devices, Windows, macOS
Identify Attack Surface: Determine if the target environment is susceptible to External Proxy by examining the target platforms (ESXi, Linux, Network Devices).
Assess Existing Defenses: Review whether mitigations for T1090.002 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 15 / 25 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.