Techniques › T1598.002 › AN1997
AN1997 Analytic 1997
PRE · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Monitor network data for uncommon data flows. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Monitor for suspicious email activity, such as numerous accounts receiving messages from a single unusual/unknown sender. Filtering based on DKIM+SPF or header analysis can help detect when the email sender is spoofed. Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)).</p>
- Detects
- T1598.002 Spearphishing Attachment
- Part of
- DET0865 Detection of Spearphishing Attachment
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| Network Traffic | None | DC0078 Network Traffic Flow |
| Application Log | None | DC0038 Application Log Content |
| Network Traffic | None | DC0085 Network Traffic Content |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2021-33739 | Microsoft Windows | Mapped |