Techniques › T1595.002 › AN1999
AN1999 Analytic 1999
PRE · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)). Monitor network data for uncommon data flows. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.</p>
- Detects
- T1595.002 Vulnerability Scanning
- Part of
- DET0867 Detection of Vulnerability Scanning
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| Network Traffic | None | DC0085 Network Traffic Content |
| Network Traffic | None | DC0078 Network Traffic Flow |