DetectD3-RPA
Relay Pattern Analysis
Also called: Relay Network Detection
Definition
The detection of an internal host relaying traffic between the internal network and the external network.
- D3FEND ID
- D3-RPA
- Tactic
- Detect
- Certification relevance
- CySA+GCIHGCIASecurity+
ATT&CK techniques it counters
18 techniques, 50 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
- T1001Data Obfuscation
- T1008Fallback Channels
- T1048Exfiltration Over Alternative Protocol
- T1071Application Layer Protocol
- T1090Proxy
- T1095Non-Application Layer Protocol
- T1102Web Service
- T1104Multi-Stage Channels
- T1105Ingress Tool Transfer
- T1132Data Encoding
- T1197BITS Jobs
- T1204User Execution
- T1219Remote Access Tools
- T1567Exfiltration Over Web Service
- T1568Dynamic Resolution
- T1571Non-Standard Port
- T1572Protocol Tunneling
- T1573Encrypted Channel
Across MITRE's defensive frameworks
Linked through the 18 ATT&CK techniques above.
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2021-05-005BITSAdmin Download File2 shared
- CAR-2021-05-002Batch File Write to System321 shared
- CAR-2021-05-004BITS Job Persistence1 shared
- CAR-2021-05-006CertUtil Download With URLCache and Split Arguments1 shared
- CAR-2021-05-007CertUtil Download With VerifyCtl and Split Arguments1 shared
- CAR-2013-07-001Suspicious Arguments1 shared