Automated Exfiltration: Traffic Duplication T1020.001

Tactic: Exfiltration

Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure. Traffic mirroring is a native feature for some devices, often used for network analysis. For example, devices may be configured to forward network traffic to one or more destinations for analysis by a network analyzer or other monitoring device.

Authoring guide

These 1 rule share fields, values, and exclusions.

Fields filtered most (3 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
command1starts_with 1monitor session
facility1eq 1mirror, span
mnemonic1eq 1cfglog_loggedcmd, eth_span_session_up, pktcap_start

Top indicator values (7 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
commandstarts_with
monitor session
1
facilityeq
mirror
1
facilityeq
span
1
mnemoniceq
cfglog_loggedcmd
1
mnemoniceq
eth_span_session_up
1
mnemoniceq
pktcap_start
1
mnemoniceq
session_up
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: Network

Domain: Network

Splunk 1 rule