Techniques › T1665 › AN1149
AN1149 Analytic 1149
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detect adversaries filtering traffic or modifying server responses to evade scanning. Monitor iptables, nftables, or proxy configurations that deny or redirect requests from known scanning agents or defensive tools.</p>
- Detects
- T1665 Hide Infrastructure
- Part of
- DET0411 Detection Strategy for Hide Infrastructure
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | execve: Execution of commands modifying iptables/nftables to block selective IPs | DC0032 Process Creation |
| NSM:Flow | Altered response metadata or blocked content based on user-agent or geolocation | DC0106 Response Metadata |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
BlockedAgents | User-agent strings or scanning tools to monitor for selective filtering. |