How outgoing tunnels are not stopped by AV or firewalls?

Question

How can an attacker with initial access to a server behind a firewall, which only has SSH, HTTPS, and HTTP ports open, maintain remote access to the server even after the SSH port is closed by the user on the firewall?

I have searched these questions and answers but none of them directly answering the question:

• How do persistent reverse shells and other malware gain their persistancy?
• Why would people connect to reverse shell's server side?
• When to use a Bind shell vs. a Reverse shell?

I knew its by implementing any kind of reverse shell, creating a tunnel that sending outbound connection to attacker server: Why a tunnel - reverse shell not detected by Firewall or such Antivirus on the OS? until this point, I worked on many computers and tested if a tunnel works or not, none of them blocked me even with enterprise firewall and client security software.

Answer 1

Because there is nothing inherently wrong with a computer connecting out to the internet. Your browser does this multiple times a minute when in use.

AV can detect binaries that are known to be potentially used for malicious purposes. But the same tools used for troubleshooting (e.g. netcat) can also be used for malicious purposes.

And firewalls do detect strange outgoing connections. If the connections are, indeed, strange. Some firewalls ask the user if all outgoing connections are authorised (Windows used to do this) but users were bombarded with connection requests to approve, so that approach was abandoned.

As for servers, the basic hardening guidance is to only allow outgoing connections that are pre-approved (IP lists), and this cuts down on the chance for tunnels to succeed.