synoti logosynoti logo
Netflow

Detection rules for Netflow Data sources. Every rule contains its MITRE ATT&CK mapping, an impact rating, and details on what it identifies.

This category lists 12 detection rules.

RuleCategoryTechniqueImpact (C/I/A)
Abnormally Long-Lived Network ConnectionCommand and ControlT1571 - Non-Standard PortC:2 / I:1 / A:1
C2 Beaconing Behavior DetectionCommand and ControlT1071 - Application Layer ProtocolC:2 / I:2 / A:1
Cryptocurrency Mining Pool Traffic DetectionResource HijackingT1496 - Resource HijackingC:1 / I:2 / A:3
DDoS Attack Pattern DetectionImpactT1498 - Network Denial of ServiceC:1 / I:1 / A:3
DNS-over-HTTPS (DoH) Traffic DetectionCommand and ControlT1071.004 - Application Layer Protocol: DNSC:1 / I:0 / A:0
Data Exfiltration DetectionExfiltrationT1041 - Exfiltration Over C2 ChannelC:3 / I:2 / A:1
ICMP Tunneling Detection via NetFlowCommand and ControlT1095 - Non-Application Layer ProtocolC:3 / I:2 / A:1
Internal Network Host Scanning DetectionDiscoveryT1046 - Network Service ScanningC:2 / I:1 / A:1
Internal SMB/RDP Lateral Movement DetectionLateral MovementT1021 - Remote ServicesC:3 / I:3 / A:2
Port Scanning Activity DetectionDiscoveryT1046 - Network Service ScanningC:2 / I:1 / A:1
Tor Network Usage DetectionCommand and ControlT1090 - Proxy: Multi-hop ProxyC:3 / I:2 / A:1
VPN Protocol to Non-Corporate DestinationExfiltrationT1572 - Protocol TunnelingC:3 / I:2 / A:1

Rule Example

Below is an example of a rule definition for Abnormally Long-Lived Network Connection (view in repository):

# Rule version v1.0.0

dataTypes:
  - netflow
name: Abnormally Long-Lived Network Connection
impact:
  confidentiality: 2
  integrity: 1
  availability: 1
category: Command and Control
technique: "T1571 - Non-Standard Port"
adversary: origin
references:
  - https://attack.mitre.org/techniques/T1571/
  - https://www.cisco.com/en/US/technologies/tk648/tk362/technologies_white_paper09186a00800a3db9.html
description: |
  Detects abnormally long-lived network connections (lasting over 24 hours) to external destinations. Persistent connections may indicate C2 channels, backdoor access, or data exfiltration tunnels that maintain ongoing communication.

  Next Steps:
  1. Investigate the internal host maintaining the long connection
  2. Identify the application or process responsible for the connection
  3. Review the destination IP and port for known C2 indicators
  4. Check the data transfer volume during the connection
  5. Review connection patterns for beaconing behavior
  6. If suspicious, terminate the connection and scan the host
where: |
  exists("origin.ip") &&
  exists("target.ip") &&
  greaterThan("log.duration", 86400) &&
  equals("protocol", "TCP") &&
  !inCIDR("target.ip", "10.0.0.0/8") &&
  !inCIDR("target.ip", "172.16.0.0/12") &&
  !inCIDR("target.ip", "192.168.0.0/16") &&
  !oneOf("target.port", [443, 80, 22, 993, 995, 587])
groupBy:
  - adversary.ip
  - target.ip
  - target.port

Rule Details

Abnormally Long-Lived Network Connection

Identifies network connections to external endpoints that remain active for unusually long periods, exceeding 24 hours. Such persistent links can signal command-and-control channels, backdoor access, or exfiltration tunnels sustaining continuous communication.

C2 Beaconing Behavior Detection

Identifies possible command-and-control beaconing activity through regularly spaced connections with uniform intervals and limited data transfer. The rule spots suspicious network behavior in which an internal machine repeatedly opens small connections to an external host, potentially signaling C2 communication.

Cryptocurrency Mining Pool Traffic Detection

Identifies network connections to recognized cryptocurrency mining pool ports, including Stratum protocol on 3333, 4444, 5555, 7777, 8888, 9999, and 14444. Internal hosts reaching mining pools point to cryptojacking or unapproved mining activity.

DDoS Attack Pattern Detection

Identifies possible DDoS attack patterns by detecting a high volume of network flows from many sources aimed at one destination in a brief time frame. The rule flags suspicious traffic levels that could point to volumetric DDoS attacks, including UDP floods, TCP floods, or other amplification attacks.

DNS-over-HTTPS (DoH) Traffic Detection

Identifies DNS-over-HTTPS traffic directed to recognized public DoH resolvers. Although DoH offers privacy, malware and attackers exploit it to evade DNS monitoring and exfiltrate data via encrypted DNS channels.

Data Exfiltration Detection

Identifies possible data exfiltration by spotting unusually large outbound transfers to external IP addresses. The rule detects network flows in which substantial data amounts (>10MB) move from internal systems to external destinations in other countries, potentially signaling unauthorized data theft or exfiltration attempts.

ICMP Tunneling Detection via NetFlow

Identifies possible ICMP tunneling by spotting ICMP traffic with abnormally large packet sizes or high data volumes. Attackers employ ICMP tunneling, using tools such as ptunnel and icmpsh, to exfiltrate data or create covert C2 channels over protocols frequently permitted by firewalls.

Internal Network Host Scanning Detection

Identifies east-west network scanning in which an internal host reaches numerous other internal hosts on one or several ports, suggesting internal reconnaissance or worm spread.

Internal SMB/RDP Lateral Movement Detection

Identifies internal hosts that connect to several internal targets over SMB (445) or RDP (3389) ports within a brief time frame, suggesting possible lateral movement or internal reconnaissance.

Port Scanning Activity Detection

Identifies port scanning activity by recognizing connection patterns that touch multiple ports while transferring minimal data. This may point to reconnaissance or vulnerability scanning efforts.

Tor Network Usage Detection

Identifies possible Tor network usage through connections to recognized Tor entry node ports (9001, 9030, 9050, 9051) and traffic patterns matching Tor activity. Attackers often use Tor to anonymize their traffic and avoid detection.

VPN Protocol to Non-Corporate Destination

Identifies VPN protocol traffic (OpenVPN, WireGuard, IPsec) from internal hosts to external destinations outside the corporate network. This can signal data exfiltration via unauthorized VPN tunnels or VPN usage that violates policy.