Skip to main content

FRP / Plink

This is a defensive tool-intelligence page. It is intended for analyst navigation, source review, and hunt planning. It is not a malware-analysis report and does not contain sample code or binaries.

Summary

  • Associated actor(s): Magic Hound
  • Tool type(s): Dual-use tunneling / proxy tooling
  • Confidence level(s): Medium
  • Source ID(s): SRC-MITRE-G0059

Behavior

ActorBehavior Summary
Magic HoundMITRE reports Magic Hound use of Fast Reverse Proxy and Plink-style tooling for proxying, masqueraded access, and non-standard C2 routing.

Hash And IOC Status

ActorStatusReference
Magic HoundNo malware hash; dual-use binary monitoring and local allowlisting required.SRC-MITRE-G0059

Hashes and IOCs on this page are source pointers or representative public indicators. They SHOULD be refreshed from the linked source before operational use and MUST NOT be used alone for actor attribution.

Defensive Hunting Notes

ActorHunting Notes
Magic HoundHunt FRP/Plink execution from user paths or server paths, masqueraded filenames, non-standard ports, and unauthorized proxy sessions.

Handling Notes

ActorHandling Notes
Magic HoundDual-use; tool presence alone is not attribution.

Mapped ATT&CK Techniques For Associated Actor(s)

ActorTechniqueTacticMapping QualitySource
Magic HoundT1566.002 Spearphishing LinkInitial AccessM2SRC-MITRE-G0059
Magic HoundT1583.001 Acquire DomainsResource DevelopmentM1SRC-MITRE-G0059

These detections are mapped through the associated actor or scenario and are not automatically tool-specific. Promote a tool-specific detection only after the behavior is tied to telemetry and test evidence.

ActorDetectionRelease StatusDRLRule
Magic HoundDET-004 - Mail Click To Execution CorrelationHunt4detections/kql/mail-click-to-exec-correlation.kql

These hunts are mapped through the associated actor or scenario and may need narrowing before they are used for this specific tool.

ActorHuntHypothesisQuery
Magic HoundHUNT-004If VIP phishing is active then mail click events will correlate to risky sign-in or executiondetections/kql/mail-click-to-exec-correlation.kql

Source Review

SourcePublisherDateReliabilityTypeLast Reviewed
SRC-MITRE-G0059MITRE ATT&CK2026-05-13AKnowledge base2026-05-14

If a source publishes a large or frequently changing IOC appendix, keep the current IOC list in the source system or TIP and store only the pointer here.