CIS-13.8 Deploy a Network Intrusion Prevention Solution

• T1001 Data Obfuscation — Network intrusion prevention solutions can use signatures for known adversary traffic patterns to block obfuscated command-and-control activity that remains identifiable at the network level. • T1001.001 Junk Data — Network intrusion prevention solutions can use signatures for known adversary traffic patterns to block command-and-control communications that use junk data for obfuscation. • T1001.002 Steganography — Network intrusion prevention solutions can use signatures for known adversary traffic patterns to block network activity that uses identifiable steganographic methods. • T1001.003 Protocol or Service Impersonation — Network intrusion prevention solutions can use signatures for known adversary traffic patterns to block command-and-control activity that impersonates legitimate protocols or services. • T1008 Fallback Channels — Network intrusion prevention solutions can use malware- and protocol-specific signatures to block identifiable fallback command-and-control channels at monitored network boundaries. • T1029 Scheduled Transfer — Network intrusion prevention solutions can use signatures for known adversary infrastructure and malware to block identifiable scheduled command-and-control or data-transfer activity. • T1030 Data Transfer Size Limits — Network intrusion prevention solutions can use signatures associated with known adversary infrastructure and malware to block command-and-control traffic that varies transfer size to evade controls. • T1041 Exfiltration Over C2 Channel — Network intrusion prevention solutions can use malware- and protocol-specific signatures to block identifiable exfiltration occurring over command-and-control channels. • T1046 Network Service Discovery — Network intrusion prevention solutions can identify and block remote service scanning that crosses monitored network boundaries. • T1048 Exfiltration Over Alternative Protocol — Network intrusion prevention solutions can use signatures for known adversary infrastructure, malware, and unusual protocol activity to block exfiltration over alternative protocols. • T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol — Network intrusion prevention solutions can use signatures for known adversary infrastructure, malware, and unusual protocol activity to block exfiltration over symmetrically encrypted non-command-and-control protocols. • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol — Network intrusion prevention solutions can use signatures for known adversary infrastructure, malware, and unusual protocol activity to block exfiltration over asymmetrically encrypted non-command-and-control protocols. • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol — Network intrusion prevention solutions can use signatures for known adversary infrastructure, malware, and unusual protocol activity to block exfiltration over unencrypted non-command-and-control protocols. • T1071 Application Layer Protocol — Network intrusion prevention solutions can use signatures for known malicious application-layer traffic to block adversary command-and-control communications at monitored network boundaries. • T1071.001 Web Protocols — Network intrusion prevention solutions can use signatures for malicious HTTP or HTTPS traffic associated with specific adversary tools to block command-and-control activity at the network boundary. • T1071.002 File Transfer Protocols — Network intrusion prevention solutions can use signatures for malicious file-transfer protocol traffic associated with specific adversary tools to block activity at monitored network boundaries. • T1071.003 Mail Protocols — Network intrusion prevention solutions can use signatures for malicious mail-protocol traffic associated with specific adversary tools to block activity at monitored network boundaries. • T1071.004 DNS — Network intrusion prevention solutions can use signatures for malicious DNS traffic associated with specific adversary tools to block command-and-control activity at monitored network boundaries. • T1071.005 Publish/Subscribe Protocols — Network intrusion prevention solutions can use signatures for malicious publish/subscribe protocol traffic associated with specific adversary tools to block activity at monitored network boundaries. • T1090 Proxy — Network intrusion prevention solutions can use malware- and protocol-specific signatures to block identifiable proxy communications used for adversary command and control. • T1090.001 Internal Proxy — Network intrusion prevention solutions can use malware- and protocol-specific signatures to block identifiable internal proxy communications used for adversary command and control. • T1090.002 External Proxy — Network intrusion prevention solutions can use malware- and protocol-specific signatures to block identifiable external proxy communications used for adversary command and control. • T1095 Non-Application Layer Protocol — Network intrusion prevention solutions can use signatures for known adversary malware to block malicious use of non-application-layer protocols at monitored network boundaries. • T1102 Web Service — Network intrusion prevention solutions can use signatures for known adversary malware to block identifiable command-and-control traffic using web services. • T1102.001 Dead Drop Resolver — Network intrusion prevention solutions can use signatures for known adversary malware to block identifiable traffic to web services used as dead-drop resolvers. • T1102.002 Bidirectional Communication — Network intrusion prevention solutions can use signatures for known adversary malware to block identifiable bidirectional command-and-control traffic using web services. • T1102.003 One-Way Communication — Network intrusion prevention solutions can use signatures for known adversary malware to block identifiable one-way command-and-control traffic using web services. • T1104 Multi-Stage Channels — Network intrusion prevention solutions can use signatures for known adversary malware to block identifiable traffic associated with multi-stage command-and-control channels. • T1105 Ingress Tool Transfer — Network intrusion prevention solutions can identify known malicious transfer patterns or unusual transfers over protocols such as FTP and block the associated tool-transfer activity. • T1132 Data Encoding — Network intrusion prevention solutions can use protocol and malware-specific signatures to identify encoded command-and-control traffic and block matching activity at monitored network boundaries. • T1132.001 Standard Encoding — Network intrusion prevention solutions can use signatures for known protocol indicators and standard encoding patterns used by adversary tools to block matching network activity. • T1132.002 Non-Standard Encoding — Network intrusion prevention solutions can use signatures for known protocol indicators and non-standard encoding patterns used by adversary tools to block matching network activity. • T1204 User Execution — When user execution depends on visiting a malicious link or retrieving malicious content, network intrusion prevention solutions can block the associated network request or download. • T1204.001 Malicious Link — Network intrusion prevention solutions can block requests to malicious links and prevent associated content from being downloaded across monitored network boundaries. • T1204.003 Malicious Image — Network intrusion prevention solutions can block malicious image downloads when the content or associated network activity matches known malicious indicators. • T1204.004 Malicious Copy and Paste — Network intrusion prevention solutions can block network requests for malicious content used in copy-and-paste execution workflows when the destination or traffic matches known malicious indicators. • T1204.005 Malicious Library — Network intrusion prevention solutions can block malicious library downloads when the content or associated network activity matches known malicious indicators. • T1219 Remote Access Tools — Network intrusion prevention solutions can use network signatures to block traffic associated with unauthorized remote-access services. • T1221 Template Injection — Network intrusion prevention solutions can block network activity that attempts to fetch or execute malicious payloads through externally referenced document templates. • T1542.004 ROMMONkit — Network intrusion prevention solutions can use signatures for protocols such as TFTP to block identifiable network activity associated with unauthorized modification of network-device boot components. • T1542.005 TFTP Boot — Network intrusion prevention solutions can use signatures for protocols such as TFTP to block unauthorized TFTP traffic associated with network-device boot activity. • T1557 Adversary-in-the-Middle — Network intrusion prevention solutions can identify traffic patterns associated with adversary-in-the-middle activity and block the activity at monitored network boundaries. • T1557.001 Name Resolution Poisoning and SMB Relay — Network intrusion prevention solutions can identify traffic patterns associated with name-resolution poisoning and SMB relay activity and block the activity at monitored network boundaries. • T1557.002 ARP Cache Poisoning — Network intrusion prevention solutions can identify traffic patterns associated with ARP cache poisoning and block the activity where the relevant network traffic is monitored. • T1557.003 DHCP Spoofing — Network intrusion prevention solutions can identify traffic patterns associated with DHCP spoofing and block the activity where the relevant network traffic is monitored. • T1557.004 Evil Twin — Wireless intrusion prevention capabilities can identify rogue access points and traffic patterns associated with evil-twin activity and block or contain the unauthorized wireless connection. • T1566 Phishing — Network intrusion prevention solutions and network-based content controls can block malicious email links or attachments before they reach or execute on enterprise assets. • T1566.001 Spearphishing Attachment — Network intrusion prevention solutions and network-based content controls can block malicious email attachments before they reach or execute on enterprise assets. • T1568 Dynamic Resolution — Network intrusion prevention solutions can use signatures and known indicators associated with dynamically resolved adversary infrastructure to block matching command-and-control traffic. • T1568.002 Domain Generation Algorithms — Network intrusion prevention solutions can block traffic to domains or patterns associated with known domain-generation algorithms when those indicators can be identified in advance or during network activity. • T1570 Lateral Tool Transfer — Network intrusion prevention solutions can identify known malicious transfer patterns or unusual transfers over common tools and protocols and block lateral tool-transfer activity. • T1571 Non-Standard Port — Network intrusion prevention solutions can use signatures for known adversary malware to block malicious traffic using non-standard ports at monitored network boundaries. • T1572 Protocol Tunneling — Network intrusion prevention solutions can use signatures for known adversary malware and tunneling traffic to block identifiable protocol-tunneling activity at monitored network boundaries. • T1573 Encrypted Channel — Network intrusion prevention solutions can use observable network signatures associated with known adversary malware to block encrypted command-and-control traffic at monitored boundaries. • T1573.001 Symmetric Cryptography — Network intrusion prevention solutions can use observable network signatures associated with known adversary malware to block command-and-control traffic protected with symmetric cryptography. • T1573.002 Asymmetric Cryptography — Network intrusion prevention solutions can use observable network signatures associated with known adversary malware to block command-and-control traffic protected with asymmetric cryptography. • T1602 Data from Configuration Repository — Configure network intrusion prevention solutions to identify and block unauthorized management queries and commands used to access network-device configuration repositories. • T1602.001 SNMP (MIB Dump) — Configure network intrusion prevention solutions to identify and block SNMP queries and commands originating from unauthorized sources. • T1602.002 Network Device Configuration Dump — Configure network intrusion prevention solutions to identify and block unauthorized SNMP activity and unexpected Smart Install usage directed at network devices.