漏洞情报分析系统

系统在线只读模式数据管理

D3FEND 技术详情

D3-RPA

D3-RPA

Relay Pattern Analysis

定义

The detection of an internal host relaying traffic between the internal network and the external network.

父技术

D3-NTANetwork Traffic Analysis

子技术

无

关联构件

OutboundInternetNetworkTraffic

Outbound Internet Network Traffic

Outbound internet network traffic is network traffic on an outgoing connection initiated from a host within a network to a host outside the network.

语义关系

出向analyzesOutbound Internet Network Traffic

出向kb referenceReference - Malicious relay detection on networks - VECTRA NETWORKS Inc

关联 ATT&CK

31

T0884Connection Proxy

Detect · Network Traffic Analysis

Outbound Internet Network Traffic may-produce Outbound Internet Network Traffic · analyzes

T1001Data Obfuscation

Detect · Network Traffic Analysis

Outbound Internet Network Traffic produces Outbound Internet Network Traffic · analyzes

T1008Fallback Channels

Detect · Network Traffic Analysis

Outbound Internet Network Traffic produces Outbound Internet Network Traffic · analyzes

T1048.001Exfiltration Over Symmetric Encrypted Non-C2 Protocol

Detect · Network Traffic Analysis

Outbound Internet Encrypted Traffic produces Outbound Internet Network Traffic · analyzes

T1048.002Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Detect · Network Traffic Analysis

Outbound Internet Encrypted Traffic produces Outbound Internet Network Traffic · analyzes

T1048.003Exfiltration Over Unencrypted Non-C2 Protocol

Detect · Network Traffic Analysis

Outbound Internet Network Traffic produces Outbound Internet Network Traffic · analyzes

T1071Application Layer Protocol

Detect · Network Traffic Analysis

Outbound Internet Network Traffic produces Outbound Internet Network Traffic · analyzes

T1071.001Web Protocols

Detect · Network Traffic Analysis

Outbound Internet Web Traffic produces Outbound Internet Network Traffic · analyzes

T1071.002File Transfer Protocols

Detect · Network Traffic Analysis

Outbound Internet File Transfer Traffic produces Outbound Internet Network Traffic · analyzes

T1071.003Mail Protocols

Detect · Network Traffic Analysis

Outbound Internet Mail Traffic produces Outbound Internet Network Traffic · analyzes

Detect · Network Traffic Analysis

Outbound Internet DNS Lookup Traffic produces Outbound Internet Network Traffic · analyzes

T1090.002External Proxy

Detect · Network Traffic Analysis

Outbound Internet Network Traffic produces Outbound Internet Network Traffic · analyzes

T1090.003Multi-hop Proxy

Detect · Network Traffic Analysis

Outbound Internet Network Traffic produces Outbound Internet Network Traffic · analyzes

T1090.004Domain Fronting

Detect · Network Traffic Analysis

Outbound Internet Encrypted Web Traffic produces Outbound Internet Network Traffic · analyzes

T1095Non-Application Layer Protocol

Detect · Network Traffic Analysis

Outbound Internet Network Traffic produces Outbound Internet Network Traffic · analyzes

T1102Web Service

Detect · Network Traffic Analysis

Outbound Internet Web Traffic produces Outbound Internet Network Traffic · analyzes

T1104Multi-Stage Channels

Detect · Network Traffic Analysis

Outbound Internet Network Traffic produces Outbound Internet Network Traffic · analyzes

T1105Ingress Tool Transfer

Detect · Network Traffic Analysis

Outbound Internet Network Traffic produces Outbound Internet Network Traffic · analyzes

T1132Data Encoding

Detect · Network Traffic Analysis

Outbound Internet Network Traffic produces Outbound Internet Network Traffic · analyzes

T1197BITS Jobs

Detect · Network Traffic Analysis

Outbound Internet Web Traffic may-produce Outbound Internet Network Traffic · analyzes

T1204.001Malicious Link

Detect · Network Traffic Analysis

Outbound Internet Web Traffic produces Outbound Internet Network Traffic · analyzes

T1219Remote Access Tools

Detect · Network Traffic Analysis

Outbound Internet Network Traffic produces Outbound Internet Network Traffic · analyzes

T1567Exfiltration Over Web Service

Detect · Network Traffic Analysis

Outbound Internet Web Traffic produces Outbound Internet Network Traffic · analyzes

T1567.001Exfiltration to Code Repository

Detect · Network Traffic Analysis

Outbound Internet Encrypted Web Traffic may-produce Outbound Internet Network Traffic · analyzes

Detect · Network Traffic Analysis

Outbound Internet Encrypted Remote Terminal Traffic may-produce Outbound Internet Network Traffic · analyzes

T1567.002Exfiltration to Cloud Storage

Detect · Network Traffic Analysis

Outbound Internet Encrypted Web Traffic produces Outbound Internet Network Traffic · analyzes

T1568Dynamic Resolution

Detect · Network Traffic Analysis

Outbound Internet DNS Lookup Traffic produces Outbound Internet Network Traffic · analyzes

T1571Non-Standard Port

Detect · Network Traffic Analysis

Outbound Internet Network Traffic produces Outbound Internet Network Traffic · analyzes

T1572Protocol Tunneling

Detect · Network Traffic Analysis

Outbound Internet Network Traffic produces Outbound Internet Network Traffic · analyzes

T1573Encrypted Channel

Detect · Network Traffic Analysis

Outbound Internet Encrypted Traffic produces Outbound Internet Network Traffic · analyzes

T1573.001Symmetric Cryptography

Detect · Network Traffic Analysis

Outbound Internet Encrypted Traffic creates Outbound Internet Network Traffic · analyzes

T1573.002Asymmetric Cryptography

Detect · Network Traffic Analysis

Outbound Internet Encrypted Traffic creates Outbound Internet Network Traffic · analyzes

查看关系图在矩阵中定位