Encrypted Tunnels are network channels that protect traffic contents between endpoints using encryption. Attackers use them to hide command-and-control, data theft, and lateral movement inside apparently legitimate traffic, so defenders monitor destination, process, certificate, and volume patterns, and restrict unexpected tunnelling from endpoints and servers.
How Encrypted Tunnels Work
Encrypted tunnels create a protected channel between two endpoints so the traffic inside it is unreadable in transit. The tunnel itself may be completely ordinary from a network perspective, which is why defenders have to look at context as well as content.
Encryption does not make a tunnel inherently safe, because the same mechanism that protects legitimate remote access can also protect hostile traffic. A tunnel can carry authentication, application requests, file transfers, or command traffic while concealing what is happening from basic packet inspection.
Why Attackers Abuse Encrypted Tunnels
Attackers value encrypted tunnels because they reduce visibility and help traffic blend into approved protocols and ports. That makes them useful for command-and-control, exfiltration, and lateral movement, especially when the tunnel endpoint is a normal workstation, server, or cloud service.
The security problem is not encryption itself, but the mismatch between expected and actual behaviour. A process that suddenly opens an encrypted outbound tunnel, reaches unusual destinations, or moves more data than normal can signal abuse even when the payload remains hidden. MITRE D3FEND Guide helps defenders connect those observations to specific defensive techniques, including network traffic policy mapping and encrypted tunnel detection.
What Defenders Look For
Because tunnel contents are intentionally opaque, detection usually depends on surrounding signals. Destination reputation, certificate patterns, process lineage, connection timing, session length, data volume, and unusual protocol use can all help distinguish legitimate remote access from covert tunnelling.
Defenders also compare the tunnel against the asset’s normal role. A database server, build runner, or employee laptop that initiates unexpected encrypted egress deserves more scrutiny than a known VPN gateway or managed remote-access service. The point is to identify whether the tunnel matches an approved business function.
How Organisations Reduce Tunnelling Exposure
The most effective controls limit who can create tunnels, where they can go, and what they can carry. That usually means egress filtering, endpoint process controls, certificate and proxy inspection where appropriate, and tighter review of remote-access paths that are allowed to establish long-lived encrypted sessions.
It also helps to align the control model with broader network security guidance. MITRE ATT&CK Enterprise Matrix is useful for mapping tunnelling behaviour to lateral movement, command-and-control, and credential access patterns, while NIST Privacy Framework can support data-handling decisions when encrypted channels carry sensitive information across trust boundaries. For baseline hardening, CIS Benchmarks help reduce the endpoint and server conditions that make covert tunnelling easier to establish.
Risk and Threat Considerations
Encrypted tunnels create a visibility gap that adversaries can exploit to hide control traffic or data theft inside channels defenders are reluctant to block. The risk increases when organisations treat encryption as proof of legitimacy rather than checking whether the destination, process, and traffic pattern make sense for the host.
Failure mechanism: A compromised endpoint or server establishes an encrypted outbound tunnel that bypasses routine inspection, then uses that channel for staging, command-and-control, or exfiltration.
Impact: Sensitive data can leave the environment unnoticed, attacker control can persist longer, and the tunnel may also provide a path for additional lateral movement or follow-on compromise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1090 — Proxy | Encrypted tunnels often support proxy-like concealment of command traffic and exfiltration. |
| Recommendation — Map tunnel patterns to proxy abuse and hunt for hidden command-and-control activity. | ||
| CIS Controls v8 | CIS-13 — Network Monitoring and Defense | Encrypted tunnels require traffic monitoring, egress control, and anomaly detection. |
| Recommendation — Monitor outbound tunnels and restrict unexpected encrypted egress paths. | ||
| NIST CSF 2.0 | DE.CM-01 — The network is monitored to detect potential cybersecurity events | Encrypted tunnels are detected through network monitoring and behaviour analysis. |
| PR.DS-01 — Data-at-rest is protected | Tunnel abuse can facilitate data exposure, making data protection controls relevant. | |
| Recommendation — Baseline normal tunnelling behaviour and alert on anomalous encrypted connections. Protect sensitive data so tunnel abuse is less valuable to an attacker. | ||
Practitioner Guidance
What to watch for: Treat encrypted tunnels as a behavioural question, not just a network feature. Investigate unexpected destinations, new certificates, unusual parent processes, or a volume pattern that does not fit the host’s normal job. If a tunnel is legitimate, document the business reason and make sure the allowed pattern is narrow enough to be monitorable.
Practitioner takeaway: The strongest defence is not blocking all encryption, it is making sure only approved tunnels can exist, and that any unapproved tunnel stands out quickly.
Related resources from NHI Mgmt Group
- Why do SSH tunnels create security risk even when the traffic is encrypted?
- How do organisations decide whether encrypted computation is enough for a use case?
- What do teams get wrong when they rely on encrypted tunnelling for access security?
- How should security teams govern encrypted file access in enterprise environments?