ATT&CK T1040 - Possible Network Sniffing: Unusual Protocol Mix

Darshan Thummar@Mighty

•updated Jun 10, 2026•1•0•3

This rule detects potential network sniffing by identifying an unusual mix of network protocols originating from a single source IP address. Specifically, it triggers an alert if a source IP sends 10 or more packets within 60 seconds that are neither TCP (protocol 6), UDP (protocol 17), nor ICMP (protocol 1). This behavior could indicate an attacker using tools to capture raw network traffic, as these tools often process protocols beyond the common ones.