Connection Proxy (T0884) is how an adversary routes traffic through an intermediate system so that command and control, or access to field devices, travels along paths the network already trusts. In ATT&CK for ICS it sits under Command and Control, and its procedure examples are specific to industrial attacks: Sandworm setting up an internal proxy in the 2015 Ukraine power attack, Industroyer reaching its external server through an internal proxy, and INCONTROLLER routing messages through a PLC to reach devices behind it. This guide is for OT security engineers and SOC analysts. It focuses on what differs in OT: relays on dual-homed hosts, gateways and controllers, how ATT&CK's DET0759 analytics find them, and the allowlisting and segmentation that limit them. The enterprise detail for proxies in general is in the T1090 Proxy Defensive Guide, which this page does not repeat.
Key takeaways
- In OT, the proxy is often a trusted asset. A host or controller that is allowed to talk to the field device network becomes the relay, so firewall rules between zones are bypassed rather than broken.
- INCONTROLLER shows controllers can be relays. ATT&CK records that its PLCProxy module added an IP route to the CODESYS gateway on Schneider PLCs to route messages through the PLC to other devices.
- The signal is a host talking both ways. DET0759 looks for one process or host holding an ICS protocol connection on one side and a non-ICS or external connection on the other.
- Communication profiles beat signatures. Each asset's documented role defines which connections are allowed; alerts fire on departures from that profile.
- Network allowlists and controlled egress are the main preventive controls, alongside TLS inspection where it is feasible.
What T0884 covers
ATT&CK for ICS (v20) describes T0884 as using a connection proxy to direct traffic between systems or act as an intermediary for network communications. The definition extends to trust relationships between networks in peer-to-peer, mesh or trusted connections, within one organisation or across organisations that trust each other. Adversaries use this to manage command and control, reduce the number of outbound connections, survive connection loss, or ride existing trusted paths to avoid suspicion. Platforms are Embedded, Linux, Network Devices and Windows.
The trust relationship point matters in OT, where vendor support links, inter-site links and DMZ services are designed paths between networks. A proxy on any of them carries attacker traffic under the cover of expected flows. Related command and control techniques are Standard Application Layer Protocol (T0869) and Commonly Used Port (T0885).
Procedure examples
| Example | What ATT&CK records | Lesson |
|---|---|---|
| 2015 Ukraine Electric Power Attack (C0028) | Sandworm established an internal proxy before installing backdoors in the network | The relay is built early, so finding it can stop later stages |
| Sandworm Team (G0034) | Establishes an internal proxy prior to installing backdoors | A repeated pattern for this group |
| Industroyer (S0604) | Attempts to connect to a hardcoded internal proxy on TCP 3128, the default Squid proxy port, then reaches an external C2 server through it | Internal proxies used for legitimate web access can become the path out of OT |
| INCONTROLLER (S1045) | PLCProxy module adds an IP route to the CODESYS gateway on Schneider PLCs, routing messages through the PLC to bypass firewall rules that block direct access to devices on the PLC's network | A controller with interfaces in two networks is a potential relay |
INCONTROLLER was the subject of the April 2022 joint advisory AA22-103A from DOE, CISA, NSA and FBI, which named affected Schneider Electric and OMRON PLCs and OPC UA servers and recommended limiting ICS connections to approved management and engineering workstations. See the Sandworm Threat Actor Profile and the ICS Malware History Guide for background.
Detection: the DET0759 analytics
ATT&CK's detection strategy for T0884 has four analytics. All share an OT operational fidelity gate: alert only when the asset's documented role does not permit the connection and the destination, proxy or service is outside the approved communications profile, and suppress approved vendor support, update repositories, remote operations, failover paths and documented temporary connectivity.
| Analytic | Platform | Telemetry | What to look for |
|---|---|---|---|
| AN1891 | Linux | auditd execve, bind, listen and connect records | One process listening on an ICS protocol port while connecting out to a non-ICS destination; iptables or nftables DNAT or REDIRECT rules added on ICS protocol ports outside the administration baseline |
| AN2175 | Network | NetFlow or IPFIX | A host holding an inbound ICS protocol flow and an outbound flow outside the ICS zone at the same time, with correlated timing and byte counts that indicate relaying |
| AN2237 | Field devices | Network security monitoring of protocol content | Protocol latency inconsistent with direct communication, or a device IP answering from a MAC address different from its enrolled hardware address |
| AN2275 | Windows | Sysmon Event ID 3; Windows System log Event ID 7045 | One process connected to both the field device subnet and an external IP; a new service enabling TCP port forwarding on an ICS protocol port that is not a known ICS service |
Making it practical
- Communication profile per asset role: record which zones, ports and peers each HMI, engineering workstation, gateway and controller may use. This is the baseline every analytic depends on.
- Dual-homed hosts first: list hosts and controllers with interfaces in two networks. They are the natural relays and the best place to start monitoring.
- MAC and IP binding: keep enrolled hardware addresses for field devices in the asset inventory so AN2237 has something to compare against.
- Controller routing changes: treat new routes or gateway settings on controllers as configuration changes needing a ticket, and compare controller configurations against known good backups.
Passive OT monitoring is covered in the OT Network Security Monitoring Guide.
Prevention
| Mitigation | ATT&CK guidance | OT implementation |
|---|---|---|
| M0807 Network Allowlists | Host-based or system allowlists of which connections (IP, MAC, port, protocol) a device may make | Allowlist peers on HMIs, gateways and engineering hosts; restrict which hosts may reach controllers |
| M0937 Filter Network Traffic | Block known anonymity networks and C2 infrastructure; application-layer allowlisting for protocols such as DNP3 and Modbus | Deny outbound internet from OT zones; protocol-aware filtering at conduits |
| M0931 Network Intrusion Prevention | Signatures for adversary malware C2 protocols | Deploy at the IT and OT boundary in detect mode first, enforce after tuning |
| M0920 SSL/TLS Inspection | Inspect HTTPS traffic for domain fronting where possible | Inspect at the enterprise or DMZ boundary where privacy and vendor terms allow |
Industroyer's use of an internal web proxy argues for giving OT zones no route to general enterprise proxies. Where OT hosts need updates, use a dedicated update service in the DMZ. Segmenting IT and OT with a DMZ is also one of the primary mitigations CISA and partner agencies list for OT. Zone and conduit design is in the OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide.
Where identity fits
Vendor remote access and jump hosts are designed relays. If a vendor account or jump host credential is compromised, the proxy already exists and is approved. Broker remote access through a single controlled path with named, time-bound accounts and session recording, so that a relay through it is attributable. See the OT Remote Access Guide.
Implementation in phases
- Map flows: build the communication profile per asset role from passive monitoring and engineering input.
- Find relays: list dual-homed hosts, controllers with gateway or routing features, and paths to enterprise proxies.
- Monitor: enable flow records at conduits and host telemetry on Windows and Linux OT hosts, then run DET0759 in report-only mode.
- Restrict: apply allowlists one zone at a time, with a tested rollback of the previous rule set.
- Review: recheck the profile after each project or vendor change.
Safe response
- Confirm with operations what the relay host or controller does before blocking it, since it may carry legitimate control traffic.
- Cut the outbound leg first at the conduit, which removes attacker control while process traffic continues.
- Check controllers for added routes or gateway changes against known good backups.
- Preserve flow records, packet captures, host logs and controller configuration exports.
Metrics
- Share of OT asset roles with a documented communication profile.
- Number of dual-homed hosts and controllers, with an owner and justification for each.
- Share of conduits producing flow records to the SOC.
- OT zones with any route to general enterprise web proxies or the internet, target zero.
- Time to explain a new cross-zone flow.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| ATT&CK for ICS | TA0101, T0884, DET0759, M0807, M0937, M0931, M0920 | Technique, detection and mitigations |
| ATT&CK Enterprise | T1090 Proxy | IT equivalent |
| NIST SP 800-53 Rev. 5 | AC-4, SC-7, SI-4, CM-7 | Information flow enforcement, boundary protection, monitoring, least functionality |
| NIST CSF 2.0 | PR.IR-01, DE.CM-01 | Network protection, network monitoring |
Common failure patterns
- OT hosts configured to use the enterprise proxy: the Industroyer path out.
- Undocumented dual-homed hosts: engineering laptops or servers bridging zones without anyone knowing.
- No baseline: without communication profiles, every relay looks like normal traffic.
- Ignoring controller configuration: routing features on PLCs and gateways are never reviewed.
- Standing vendor tunnels: always-on links provide a ready relay.
Practitioner checklist
- Document a communication profile per OT asset role.
- Inventory dual-homed hosts and controllers with routing or gateway functions.
- Block OT zones from enterprise web proxies and the internet; use a DMZ update service.
- Collect flow records at every conduit and host connection telemetry on OT servers.
- Deploy the DET0759 analytics in report-only mode, then tune and alert.
- Record enrolled MAC addresses for field devices.
- Compare controller configurations with known good backups after changes.
- Broker vendor access with named, time-bound accounts.
Standards and references
- MITRE ATT&CK for ICS: Connection Proxy (T0884)
- MITRE ATT&CK Enterprise: Proxy (T1090)
- MITRE ATT&CK: INCONTROLLER (S1045)
- CISA, DOE, NSA and FBI: APT Cyber Tools Targeting ICS/SCADA Devices (AA22-103A)
- NIST: SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
- CISA, FBI, EPA and DOE: Primary Mitigations to Reduce Cyber Threats to Operational Technology
Related NHI Mgmt Group resources: MITRE ATT&CK for ICS Guide · OT Security Guide · PLC Security Guide · OT Security Operations Centre Guide