DS0029 Network Traffic
Data transmitted across a network (ex: Web, DNS, Mail, File, etc.), that is either summarized (ex: Netflow) and/or captured as raw data in an analyzable format (ex: PCAP)
| Item | Value |
|---|---|
| ID | DS0029 |
| Platforms | Android, IaaS, Linux, Windows, iOS, macOS |
| Collection Layers | Cloud Control Plane, Host, Network |
| Version | 1.1 |
| Created | 20 October 2021 |
| Last Modified | 20 April 2023 |
Data Components
Network Connection Creation
Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
Network Traffic Content
Logged network traffic data showing both protocol header and body values (ex: PCAP)
Network Traffic Flow
Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
References
-
Spencer S. (2018, February 22). DCSYNCMonitor. Retrieved March 30, 2018. ↩
-
Delpy, B. & LE TOUX, V. (n.d.). DCShadow. Retrieved March 20, 2018. ↩
-
Perry, David. (2020, August 11). WakeOnLAN (WOL). Retrieved February 17, 2021. ↩
-
Microsoft. (2020, October 13). Anti-spoofing protection in EOP. Retrieved October 19, 2020. ↩
-
Australian Cyber Security Centre. (2012, December). Mitigating Spoofed Emails Using Sender Policy Framework. Retrieved October 19, 2020. ↩
-
US-CERT. (2015, November 13). Compromised Web Servers and Web Shells - Threat Awareness and Guidance. Retrieved June 8, 2016. ↩
-
Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016. ↩
-
Jacobs, J. (2014, October 2). Building a DGA Classifier: Part 2, Feature Engineering. Retrieved February 18, 2019. ↩
-
Chen, L., Wang, T.. (2017, May 5). Detecting Algorithmically Generated Domains Using Data Visualization and N-Grams Methods . Retrieved April 26, 2019. ↩
-
Ahuja, A., Anderson, H., Grant, D., Woodbridge, J.. (2016, November 2). Predicting Domain Generation Algorithms with Long Short-Term Memory Networks. Retrieved April 26, 2019. ↩
-
Koopmann, Lennart. (n.d.). Nzyme Alerts Introduction. Retrieved September 26, 2022. ↩
-
Tomko, A.; Rieser, C; Buell, H.; Zeret, D.; Turner, W.. (2007, March). Wireless Intrusion Detection. Retrieved September 26, 2022. ↩
-
Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Secure Boot. Retrieved October 19, 2020. ↩
-
Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Cisco IOS Image File Verification. Retrieved October 19, 2020. ↩
-
Jamie Harries. (2022, May 25). Hunting a Global Telecommunications Threat: DecisiveArchitect and Its Custom Implant JustForFun. Retrieved October 18, 2022. ↩