MITRE D3FENDdefensive technique

D3-RTSD Remote Terminal Session Detection

Official page ↗
Tactic
Detect

Definition

Detection of an unauthorized remote live terminal console session by examining network traffic to a network host.

How it works

How it works An external attacker takes remote control of a host inside a company or organization's network and manually directs offensive techniques. Nonstandard terminal sessions and abnormal behaviors are analyzed in this technique. Abnormal behavior detection includes analysis of user input patterns in the real-time session, keyboard output and packet inspection. Network Traffic Inspection Network traffic from internal hosts is the main concern and focus for the traffic inspection. The network traffic is collected into inspection groups. The groups of traffic are assembled into distinct pair flows (outbound/inbound) and the pair flows are further divided into sessions. Only sessions originated inside of the network are considered for the inspection. Traffic inspection includes analysis to determine if a human is involved in the session exchanges. Time-based statistics are captured for each session being analyzed by the detection engine. Algorithm Analysis Description Analysis algorithms look for patterns in the network traffic captured from the session data. A detection engine groups the session traffic data, between the hosts, into rapid exchange instances. Analysis of rapid exchange traffic patterns can lead to the discovery of abnormal behavior which is indicative of a compromised internal host. The analysis algorithms look for patterns in the traffic which correlate to known activity (e.g., relay attacks, bot activity, bitcoin mining). Some metrics used during inspection include the following. • Number of rapid-exchange instances • Time interval between packets • Fixed cadence of traffic • Rhythm and direction of the initiation of instances • Volume of data flowing from internal to external controlling host • Data transfer characteristics • Variability in length of silent periods Considerations • Full packet capture is required which can be process intensive to analyze • Attackers that move low and slow may blend in with existing traffic resulting in false negatives

Related

Counters · MITRE ATT&CK (104)

  • T0895 Autorun Image technique
  • T0894 System Binary Proxy Execution technique
  • T1557.003 DHCP Spoofing sub-technique
  • T0888 Remote System Information Discovery technique
  • T0886 Remote Services technique
  • T1542.005 TFTP Boot sub-technique
  • T1205.001 Port Knocking sub-technique
  • T0814 Denial of Service technique
  • T0817 Drive-by Compromise technique
  • T0819 Exploit Public-Facing Application technique
  • T0822 External Remote Services technique
  • T0830 Adversary-in-the-Middle technique
  • T0840 Network Connection Enumeration technique
  • T0842 Network Sniffing technique
  • T0846 Remote System Discovery technique
  • T0848 Rogue Master technique
  • T0865 Spearphishing Attachment technique
  • T0866 Exploitation of Remote Services technique
  • T0869 Standard Application Layer Protocol technique
  • T0884 Connection Proxy technique
  • T0885 Commonly Used Port technique
  • T1573 Encrypted Channel technique
  • T1573.001 Symmetric Cryptography sub-technique
  • T1573.002 Asymmetric Cryptography sub-technique
  • T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol sub-technique
  • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol sub-technique
  • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1071.002 File Transfer Protocols sub-technique
  • T1071.003 Mail Protocols sub-technique
Show all 104 ›

Child of · MITRE D3FEND (1)

  • D3-NTA Network Traffic Analysis defensive technique

References