Proxying is the use of an intermediate system or relay to route traffic between an attacker and a victim environment. It can obscure the true source of communication, support stealthy command and control, and help intruders maintain access while blending into legitimate network flows.
What Proxying Means in an Attack Path
Proxying is not just a routing trick, it is a visibility and attribution problem. When an attacker inserts an intermediate relay between their tooling and the target environment, defenders may see the proxy’s IP, region, or hosting provider rather than the real operator, which complicates attribution and correlation.
That indirection also matters operationally because many detections are built around source reputation, geolocation, and connection history. Proxying can weaken those signals without changing the underlying malicious objective, which is why investigators have to look at behaviour, not just origin.
How Proxying Supports Stealth and Persistence
Proxying is attractive to intruders because it can make command and control traffic resemble ordinary outbound communication. If the relay is stable and reachable, it can also preserve access even when a direct path to the victim is disrupted or blocked.
In practice, proxying often sits inside a broader chain of trust abuse, where one system is used to conceal another. That can include cloud relays, compromised hosts, or short-lived infrastructure that is changed often enough to frustrate simple blocklists.
Defenders should treat proxying as a technique that changes the path of communication, not the intent of the activity. The same underlying session, tasking, or exfiltration pattern may continue even when the apparent source changes.
Detecting Proxying in Network Traffic
Detection usually depends on correlation across logs, flows, and endpoint telemetry rather than a single indicator. Sudden shifts in source IP, repeated connections through uncommon relays, unusual user-agent patterns, and traffic that exits through infrastructure rarely used by the organisation can all be useful clues.
It is also worth comparing network observations with approved egress paths and normal business dependencies. When a system that should communicate directly begins using intermediary services, the change may reveal abuse, misconfiguration, or a hidden control point introduced by an adversary.
Frameworks such as MITRE ATT&CK Enterprise Matrix and NIST Cybersecurity Framework 2.0 help teams map these observations to threat behaviour, detection coverage, and response workflows. For network-control baselines, NIST SP 800-53 Rev 5 Security and Privacy Controls provides the control structure used to govern monitoring, access control, and audit visibility.
Why Proxying Matters for Incident Response
Once proxying is suspected, responders need to assume that the apparent source may be disposable and that the real operator may be farther upstream. That means preservation of flow logs, DNS records, proxy telemetry, and endpoint evidence becomes more important than chasing the visible relay alone.
The same logic applies after containment. If the proxy path was part of an active intrusion, the organisation may need to review whether additional hosts, accounts, or secrets were used to establish or maintain that path, because the relay can be only one layer of a larger access chain.
Risk and Threat Considerations
Proxying increases the chance that malicious activity will blend into normal traffic and evade source-based detection. It also creates a resilience problem for defenders, because the relay can be swapped or rotated while the underlying compromise remains in place.
Failure mechanism: Security controls that rely on source reputation, IP allowlists, or simple geolocation checks can lose effectiveness when the attacker routes through an intermediary with a benign or changing profile.
Impact: The organisation may miss command and control, misattribute activity, or delay containment while the attacker maintains access through a concealed communication path.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1090 — Proxy | Proxying is a core adversary technique for routing traffic through intermediaries. |
| Recommendation — Map observed relay behaviour to Proxy and hunt for concealed command and control patterns. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and systems are monitored to detect potentially adverse events | Proxying is detected through monitoring of unusual flows and communication paths. |
| Recommendation — Correlate flow, DNS, and endpoint telemetry to spot traffic relayed through suspicious infrastructure. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Proxying requires log review and correlation to reconstruct the true communication path. |
| AC-4 — Information Flow Enforcement | Proxying changes information flow paths and can bypass expected routing controls. | |
| Recommendation — Review and correlate audit and network logs to reconstruct the actual source path. Enforce approved communication paths and restrict unexpected relay-based flows. | ||
| CIS Controls v8 | CIS-13 — Network Monitoring and Defense | Proxying is a network-defence problem that depends on visibility into relayed traffic. |
| Recommendation — Monitor outbound traffic patterns and investigate relayed connections that bypass expected paths. | ||
Related resources from NHI Mgmt Group
- What is the difference between proxying delegated access and giving an AI agent the user’s access token directly?
- What is the difference between proxying an AI agent's API call and minting a short-lived token for the agent?
- Why does using API Gateway and Lambda for proxying create operational risk during large-scale testing?
- What is the difference between first-party proxying and direct third-party browser fingerprinting requests?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 30, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org