CIS-13.4 Perform Traffic Filtering Between Network Segments

• T1021.002 SMB/Windows Admin Shares — Restrict SMB and Windows administrative-share communications between network segments to explicitly authorized systems and management paths. • T1021.005 VNC — Filter or block VNC traffic across network-segment boundaries, including commonly used VNC ports, except where the communication is explicitly required. • T1048 Exfiltration Over Alternative Protocol — Enforce network segmentation, proxies, and dedicated protocol services so only approved systems can communicate over protocols such as DNS, reducing opportunities to exfiltrate data through alternative protocols. • T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol — Enforce proxies or dedicated services and restrict encrypted non-command-and-control protocol traffic between segments to systems with a legitimate requirement to use those protocols. • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol — Enforce proxies or dedicated services and restrict asymmetric encrypted non-command-and-control protocol traffic between segments to approved systems and destinations. • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol — Restrict unencrypted alternative-protocol traffic between network segments and allow those protocols only where required for approved business communications. • T1071 Application Layer Protocol — Use network filtering between segments to permit only required application-layer protocols and authorized communications, limiting adversary use of application protocols for command and control. • T1071.001 Web Protocols — Restrict HTTP and HTTPS traffic crossing network-segment boundaries from critical systems to approved destinations, reducing unauthorized outbound web communications used for command and control or payload transfer. • T1071.002 File Transfer Protocols — Filter FTP and SFTP traffic between network segments so sensitive systems can transfer files only to trusted internal systems or other explicitly approved destinations. • T1071.003 Mail Protocols — Restrict SMTP, IMAP, and POP3 traffic between segments so servers and critical systems communicate only with trusted mail infrastructure, reducing unauthorized mail-based command, control, or exfiltration paths. • T1071.004 DNS — Restrict DNS traffic between segments to approved resolvers and filter requests to unknown, untrusted, or known malicious resources, reducing adversary use of DNS for command and control or concealed data transfer. • T1071.005 Publish/Subscribe Protocols — Filter publish/subscribe protocol traffic crossing segment boundaries to approved brokers, destinations, and expected ports, reducing use of untrusted resources or irregular ports for command and control. • T1090 Proxy — Use network allow and block lists to prevent traffic between network segments and known anonymity networks or command-and-control infrastructure that may be used as proxy destinations. • T1090.003 Multi-hop Proxy — Use network allow and block lists to restrict traffic to known anonymity networks and command-and-control infrastructure that may be chained together as multi-hop proxy destinations. • T1095 Non-Application Layer Protocol — Filter traffic at network-segment boundaries to prevent use of non-application-layer protocols that are not required for business operations. • T1187 Forced Authentication — Adversaries coerce systems into authenticating to attacker-controlled SMB or WebDAV resources in order to capture credential material. This control requires traffic filtering between network segments, which can block or tightly restrict SMB and WebDAV communications to untrusted or unauthorized destinations, directly preventing the outbound authentication path required by the technique. • T1190 Exploit Public-Facing Application — Restrict outbound traffic from public-facing or DMZ network segments to approved internal and external destinations, limiting post-exploitation communication from a compromised public-facing server. • T1197 BITS Jobs — Configure network filtering controls so only legitimate BITS traffic is permitted across network boundaries, restricting unauthorized BITS communications used for background transfer or execution activity. • T1205 Traffic Signaling — Use stateful filtering at network-segment boundaries to block traffic patterns used by traffic-signaling mechanisms when the signaling implementation can be identified and constrained. • T1205.001 Port Knocking — Use stateful filtering at network-segment boundaries to prevent port-knocking sequences from reaching protected systems where the signaling pattern can be constrained. • T1205.002 Socket Filters — Use stateful filtering at network-segment boundaries to block crafted traffic used to trigger socket-filter-based communication when the signaling implementation can be identified. • T1218 System Binary Proxy Execution — Use network appliances at segment boundaries to filter ingress and egress traffic and restrict unnecessary protocols or destinations that trusted system binaries could otherwise use for malicious communications. • T1218.012 Verclsid — Restrict unnecessary outbound traffic from systems that do not require external communications through Verclsid, using network filtering controls where the relevant traffic crosses a managed segment boundary. • T1219 Remote Access Tools — Configure network firewalls and proxies at segment boundaries to restrict outgoing traffic to sites and services associated with unauthorized remote-access software. • T1219.002 Remote Desktop Software — Restrict remote-desktop software traffic between network segments to authorized systems, destinations, and management paths using firewalls and proxy controls. • T1530 Data from Cloud Storage — Use network-based source restrictions and expected IP ranges when accessing cloud resources so data access is limited to authorized network locations in addition to valid user accounts. • T1537 Transfer Data to Cloud Account — Implement network-based filtering restrictions between trusted and untrusted VPCs or equivalent network segments to prohibit unauthorized data transfers to external cloud accounts. • T1552 Unsecured Credentials — Restrict network access paths to cloud instance metadata services and use filtering controls to reduce exposure of metadata interfaces that may contain temporary credentials or other authentication material. • T1552.005 Cloud Instance Metadata API — Restrict network access to the Cloud Instance Metadata API so only workloads with a legitimate requirement can reach the service, reducing adversary access to credentials and metadata through unintended network paths. • T1557 Adversary-in-the-Middle — Filtering unnecessary and legacy network traffic between network segments reduces opportunities for adversaries to establish adversary-in-the-middle conditions. • T1570 Lateral Tool Transfer — Restrict file-sharing communications such as SMB between network segments to systems with a legitimate requirement, reducing adversary opportunities to transfer tools laterally. • T1572 Protocol Tunneling — Filter network traffic between segments to untrusted, unauthorized, or known malicious destinations and restrict protocols that can be abused to tunnel communications across network boundaries. • T1599 Network Boundary Bridging — Use unaffected firewalls or routers to block unauthorized traffic that attempts to bridge established network-segment boundaries and continue monitoring to ensure the filtering remains effective. • T1599.001 Network Address Translation Traversal — Use unaffected network filtering devices to block unauthorized traffic attempting to traverse network boundaries through NAT or related boundary-bridging mechanisms. • T1602 Data from Configuration Repository — Apply network access-control rules between trusted and untrusted segments to block unauthorized management protocols used to reach configuration repositories and managed network devices. • T1602.001 SNMP (MIB Dump) — Apply network access-control rules to restrict SNMP traffic across segment boundaries to authorized management systems, preventing unauthorized retrieval of Management Information Base data. • T1602.002 Network Device Configuration Dump — Apply network access-control rules to restrict management protocols used to retrieve network-device configurations to approved management segments and authorized systems.