How do you detect HTTP CONNECT tunneling?

Detect HTTP CONNECT tunneling in forward proxy logs. Alert on CONNECT to ports other than 443, to raw IP addresses, to newly seen domains and from servers or non-browser user agents; and review very long-lived tunnel sessions with steady byte exchange. Enforce a CONNECT port allow-list on the proxy so abuse is denied and logged, and use Zeek http.log for transparent-proxy traffic. Baseline legitimate line-of-business ports first, then alert on deviations by host role.

Detecting HTTP CONNECT Tunnels: Abuse of the Proxy Method

The HTTP CONNECT method asks a proxy to open a raw TCP connection to a host and port, which is how HTTPS passes through a forward proxy. Tunneling tools and implants use the same method to reach SSH, RDP or an operator server through the corporate proxy. Because proxies see the target host and port even when the payload is encrypted, the log is the best detection surface.

Signals at a Glance

Signal	Where	ATT&CK
CONNECT to a port other than 443 (22, 3389, 4444, 8443 and similar)	Proxy logs	T1572
CONNECT to a raw IP address rather than a hostname	Proxy logs	T1090
CONNECT to a newly seen or low-reputation domain from a server	Proxy, DNS	T1090
Very long-lived TCP_TUNNEL sessions with steady byte exchange	Proxy logs	T1572
CONNECT initiated by a non-browser user agent or script interpreter	Proxy, EDR	T1071.001

Proxy Log Analytics

Squid, Zscaler, Blue Coat and most secure web gateways record the CONNECT target and port. Most browsers only need 443, so a CONNECT to any other port is an anomaly worth reviewing, and the target port tells you the protocol being tunneled. A starting query over Squid-style fields:

# Splunk (Squid access log) - CONNECT to unusual ports
index=proxy sourcetype=squid:access http_method=CONNECT
| rex field=uri "(?<dest_host>[^:]+):(?<dest_port>\d+)$"
| where dest_port!=443
| stats count AS requests, dc(dest_host) AS hosts, values(dest_port) AS ports,
        sum(bytes) AS total_bytes
    BY src_ip, user, http_user_agent
| sort - total_bytes
# tune/validate: allow 8443 and vendor-specific ports for approved SaaS and
# exclude patch infrastructure; keep user agent in the output for triage.

Duration and Destination Context

Where the gateway logs elapsed time, a CONNECT that stays open for hours is rarely a web page. Combine duration with destination age and user agent for a high-confidence result. On networks where the proxy is transparent, Zeek records CONNECT in http.log for plaintext proxy traffic:

# Zeek http.log - CONNECT with raw IP target, no TLS interception needed
zeek-cut ts id.orig_h method host uri user_agent < http.log \
  | awk -F'\t' '$3=="CONNECT" && $4 ~ /^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$/'
# tune/validate: many CONNECT URIs are host:port, so inspect uri as well as host.

Alert when a server, which should only talk to update endpoints, issues any CONNECT at all.
Review CONNECT requests where the user agent is a library string (python-requests, Go-http-client, curl) rather than a browser.
Enforce a port allow-list on the proxy: deny CONNECT to anything but 443 and a short list, so abuse fails loudly and logs.
Track first-seen destinations for each source host and alert on high-volume CONNECT to a new destination.

Vetted sources

Use your secure web gateway’s CONNECT and tunnel categories, Squid access-log documentation, SigmaHQ proxy rules, Elastic web-proxy detections and Zeek http.log. Always baseline your own environment — some line-of-business applications legitimately use non-standard CONNECT ports, so document them before alerting.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Proxy Log Analytics

Duration and Destination Context

Build Detections That Fire

Protocol Tunneling Detection

Detection Hub

SOCKS Proxy Detection

Chisel Tunnel Detection