Protocol Tunneling: Tools and Techniques

ReliaQuest outlines how attackers abuse protocol tunneling (HTTP/DNS/SSH) and legitimate tunneling tools—Plink, ngrok, and VS Code Remote Tunnels—to evade network defenses, maintain persistent C2, and exfiltrate data; the report cites dark-web activity and observed incidents, describes attack techniques and tradecraft, and provides actionable mitigations (block known relay domains, apply SRP/GPO application control, and set EDR to prevent mode) and detection recommendations.