T1020.001 Traffic Duplication

Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure. Traffic mirroring is a native feature for some devices, often used for network analysis. For example, devices may be configured to forward network traffic to one or more destinations for analysis by a network analyzer or other monitoring device. (Citation: Cisco Traffic…

Ficha en MITRE ATT&CK ↗

Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.