Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7 detections
Filters
Last updated
All Time
Detection languages
3
2
1
1
Contributors
2
2
1
1
1
Categories
3
2
2
1
1
Platforms
4
1
1
1
1
Products / Services
2
2
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
2
This rule detects network traffic duplication, specifically looking for the GRE (Generic Routing Encapsulation) protocol (IP protocol 47) being used in a way that suggests traffic mirroring via SPAN or TAP devices. The rule triggers if 10 or more GRE packets are observed from a single source IP within a 30-second window, flowing from a client to a server.
This rule detects potential VXLAN traffic duplication for exfiltration purposes. It specifically looks for TCP traffic on port 4789 (the default VXLAN port) directed towards the home network. A threshold of 10 connections from the same source within 30 seconds triggers the alert, indicating a high volume of VXLAN traffic that could be indicative of data exfiltration.
KQL Query
The following query surface network activity associated with exploitation of CVE-2022-22965.
Simple query to show the unique network connections that were audited or blocked by ExploitGuard.
For more questions on this query, feel free to ping @FlyingBlueMonki on twitter or mattegen@microsoft.com via email.
For more questions on this query, feel free to ping @FlyingBlueMonki on twitter or mattegen@microsoft.com via email.
The analytic detects the initiation of traffic mirroring sessions on Cisco network devices. It leverages logs with specific mnemonics and facilities related to traffic mirroring, such as "ETH_SPAN_SESSION_UP" and "PKTCAP_START." This activity is significant because adversaries may use traffic mirroring to exfiltrate data by duplicating and forwarding network traffic to an external destination. If confirmed malicious, this could allow attackers to capture sensitive information, monitor network communications, and potentially compromise the integrity and confidentiality of the network.
This rule identifies activities related to Google Cloud Platform (GCP) Packet Mirroring. Packet Mirroring allows capturing full network traffic, which can be abused by adversaries to intercept and collect sensitive data from unencrypted internal network communications. The rule specifically looks for various API calls related to the creation, modification, deletion, or listing of Packet Mirroring configurations.
