Techniques › T1595 › AN1962
AN1962 Analytic 1962
PRE · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Monitor network data for uncommon data flows. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)).</p>
- Detects
- T1595 Active Scanning
- Part of
- DET0830 Detection of Active Scanning
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| Network Traffic | None | DC0078 Network Traffic Flow |
| Network Traffic | None | DC0085 Network Traffic Content |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2025-0282 | Ivanti Connect Secure, Policy Secure, and ZTA Gateways | Mapped |