Automated Exfiltration: Traffic Duplication T1020.001
Tactic: Exfiltration
Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure. Traffic mirroring is a native feature for some devices, often used for network analysis. For example, devices may be configured to forward network traffic to one or more destinations for analysis by a network analyzer or other monitoring device.
Authoring guide
These 1 rule share fields, values, and exclusions.
Fields filtered most (3 distinct)
These fields appear most often in rule filters.
Top indicator values (7 distinct)
These values appear most often in rule predicates.
Rules under this technique
These vendors publish rules tagged with this technique.
Platform: Network
Domain: Network