Outbound GRE Protocol Traffic Detection

nomit vyas@xoxo

•updated Jun 25, 2026•0•0•2

This rule monitors for Generic Routing Encapsulation (GRE) network traffic originating from or destined to non-private (non-RFC1918) IP addresses. GRE is often used for tunneling protocols and can be abused to bypass network security controls or establish hidden command and control communication channels.