MITRE D3FENDdefensive technique

D3-RPA Relay Pattern Analysis

Official page ↗
Tactic
Detect
Synonyms
Relay Network Detection

Definition

The detection of an internal host relaying traffic between the internal network and the external network.

How it works

How it works A relay may use a variety of proxying, forwarding, or routing technologies to bridge a protected network with an external network. A defensive analytic to detect a relay network may compare the network sessions among multiple hosts. Hosts which have nearly similar network statistics may be part of a relay network. The statistics may include number of bytes sent to and from, time of session initiation, packet size, or packet arrival time data. Considerations Complex intranet VPNs or routing encapsulation may affect the detection analytics. In addition, unwanted packets might not be forwarded, and additional packets may be added at the relay, further complicating detection.

Related

Counters · MITRE ATT&CK (34)

  • T0884 Connection Proxy technique
  • T1573 Encrypted Channel technique
  • T1573.001 Symmetric Cryptography sub-technique
  • T1573.002 Asymmetric Cryptography sub-technique
  • T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol sub-technique
  • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol sub-technique
  • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1071.002 File Transfer Protocols sub-technique
  • T1071.003 Mail Protocols sub-technique
  • T1071.004 DNS sub-technique
  • T1572 Protocol Tunneling technique
  • T1090.002 External Proxy sub-technique
  • T1090.003 Multi-hop Proxy sub-technique
  • T1090.004 Domain Fronting sub-technique
  • T1571 Non-Standard Port technique
  • T1204.001 Malicious Link sub-technique
  • T1568 Dynamic Resolution technique
  • T1567 Exfiltration Over Web Service technique
  • T1567.001 Exfiltration to Code Repository sub-technique
  • T1567.002 Exfiltration to Cloud Storage sub-technique
  • T1197 BITS Jobs technique
  • T1204 User Execution technique
  • T1219 Remote Access Tools technique
  • T1001 Data Obfuscation technique
  • T1008 Fallback Channels technique
  • T1048 Exfiltration Over Alternative Protocol technique
  • T1071 Application Layer Protocol technique
  • T1090 Proxy technique
  • T1095 Non-Application Layer Protocol technique
Show all 34 ›

Child of · MITRE D3FEND (1)

  • D3-NTA Network Traffic Analysis defensive technique

References