{"id":"T1020.001","name":"Traffic Duplication","url":"https://attack.mitre.org/techniques/T1020/001","tactics":["exfiltration"],"platforms":["Network Devices","IaaS"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0403","stix_id":"x-mitre-detection-strategy--69c06a1c-5b36-432c-871b-813957b3c678","name":"Detection Strategy for Traffic Duplication via Mirroring in IaaS and Network Devices","url":"https://attack.mitre.org/detectionstrategies/DET0403","analytics":[{"id":"AN1131","stix_id":"x-mitre-analytic--7becb616-f907-4533-a425-08ca42440e3f","name":"Analytic 1131","description":"Configuration changes to virtual TAP/mirror policies that forward traffic to unapproved destinations. Detection correlates management plane API calls with mirrored traffic observation.","url":"https://attack.mitre.org/detectionstrategies/DET0403#AN1131","platforms":["IaaS"],"log_source_references":[{"name":"AWS:CloudTrail","channel":"CreateTrafficMirrorSession or ModifyTrafficMirrorTarget","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"aws-cloudtrail"},{"name":"AWS:VPCFlowLogs","channel":"Traffic observed on mirror destination instance","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"aws-vpcflowlogs"}],"mutable_elements":[{"field":"TimeWindow","description":"Detect mirror session creation followed by mirrored traffic within X seconds (e.g., 60s)"},{"field":"MirrorDestinationCIDR","description":"Define suspicious or external mirror targets (e.g., non-enterprise ranges)"},{"field":"UserIdentity","description":"Flag traffic mirror activity by non-privileged or unexpected IAM roles"}],"live":true,"detection_strategies":["DET0403"],"techniques":["T1020.001"]},{"id":"AN1132","stix_id":"x-mitre-analytic--0729dd54-2fda-460a-8bb3-eee02f0f3c4e","name":"Analytic 1132","description":"Unauthorized mirroring sessions initiated on routers/switches (e.g., via `monitor session`, `mirror port`) coupled with outbound traffic from mirrored interface to unexpected destinations.","url":"https://attack.mitre.org/detectionstrategies/DET0403#AN1132","platforms":["Network Devices"],"log_source_references":[{"name":"networkdevice:syslog","channel":"Config change: CLI/NETCONF/SNMP – 'monitor session', 'mirror port'","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"networkdevice-syslog"},{"name":"networkdevice:Flow","channel":"Traffic from mirrored interface to mirror target IP","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"networkdevice-flow"}],"mutable_elements":[{"field":"ConfigChangeType","description":"Tune based on accepted interface config changes (e.g., audit only mirror session creation)"},{"field":"MirrorDestinationPort","description":"Define high-risk ports used for exfil (e.g., 4443, 8443, 2055)"},{"field":"DeviceRole","description":"Define whether mirroring is expected on edge vs core vs distribution devices"}],"live":true,"detection_strategies":["DET0403"],"techniques":["T1020.001"]}],"live":true,"version":"1.0","techniques":["T1020.001"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}