---
{
  "title": "Proxy",
  "summary": "Investigate relayed connections by linking upstream and downstream traffic, process ownership, and authorized proxy roles without assuming every intermediary is malicious.",
  "topic": "networking",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "published": "2026-10-04",
  "units": [
    2
  ],
  "aliases": [
    "T1090"
  ],
  "sources": [
    {
      "title": "MITRE ATT&CK T1090: Proxy",
      "url": "https://attack.mitre.org/techniques/T1090"
    }
  ],
  "editorialVersion": 2
}
---
## An intermediary changes the visible path

A proxy receives or forwards communication on behalf of another participant. Organizations use proxies for legitimate reasons such as application delivery, access control, caching, and network administration. MITRE ATT&CK also describes adversarial proxy use as T1090, where intermediaries can relay command traffic or obscure parts of its path.

The observed peer can therefore be an intermediary rather than the original source or final controller. Identifying a proxy is a description of behavior, not a complete attribution or maliciousness verdict.

## A suspicious relay in a training network

Imagine a fictional academy notices a workstation receiving local connections and making closely timed external connections. The workstation might run an approved development proxy, a remote-support tool, or an unauthorized relay associated with compromise.

The analyst records the listening process, executable identity, account, configuration, and upstream and downstream endpoints. Timing relationships help frame a hypothesis, but similar timestamps alone do not prove that two encrypted streams contain the same data.

Compare the finding with approved services and recent changes. An unfamiliar tool deserves investigation without becoming automatic evidence of hostile intent.

## Follow both sides of the relationship

A relay can divide a communication journey across several records. One sensor may see the client-to-proxy exchange while another sees the proxy-to-destination exchange. Collection points, address translation, shared connections, and encryption affect how confidently those observations can be connected.

Preserve relevant time and endpoint context. [[packet-analysis]] explains network observations, while endpoint records can identify the process responsible for a connection. Avoid reporting the visible relay's address as the ultimate controlling infrastructure without supporting evidence.

## Containment must account for legitimate dependencies

If an unauthorized relay is confirmed, responders may need to restrict its paths, isolate the host, or stop the responsible process. Those choices should follow the incident plan and account for evidence preservation and operational impact.

Blocking an address alone may leave the compromised endpoint or stolen credentials unresolved. Conversely, removing an approved proxy without understanding its role can interrupt many legitimate users. [[network-segmentation]] helps reason about the reachable paths, and [[incident-response]] covers the broader coordinated response.

## Build an evidence-based explanation

For a safe exercise, draw an invented client, relay, and external service. Give each connection a timestamp and identify the logs available at each point. Add one legitimate explanation and one unauthorized explanation for the same topology.

State which process and configuration evidence would distinguish them. Then explain what remains uncertain if you have only a boundary flow record. Continue with [[exfiltration]] to distinguish a communication path from evidence that particular data actually left the environment. The useful outcome is a defensible account of the relay's role and the limits of the observations.