network:flow
Network flow records (Zeek conn, NetFlow, firewall flow)
- Host type
- Network devices and network sensors
- Tier, as a whole
- Minimum
- Cost class
- Included
- Techniques
- 159
- Rules listed
- 52
- Events
- 9
Why this tier
CISA CM0106; NSA/ASD web shell guidance; OMB M-26-14 A10 (Attack vectors and lateral movement; our analysis); OMB M-26-14 A2 (Network source and destination; our analysis); OMB M-26-14 A7 (Indicators of compromise; our analysis); OMB M-26-14 A8 (Anomalous activity; our analysis)
Licensing
- License or service
- Device firmware (vendor-dependent)
- What is free
- Export on most routers/firewalls
- What costs
- Some vendors license flow export; collector cost
- Notes
- UNCONFIRMED (device-specific)
- As read on
- 2026-11-01
A vendor statement as read on the date shown; the cost class is the durable part.
Standards and guidance naming this source
| Requirement | Relation | Basis |
|---|---|---|
| OMB M-26-14: Network source and destination | Supports an activity | our analysis: flow records are source destination protocol port and session |
| OMB M-26-14: Indicators of compromise | Supports an activity | our analysis: IP indicators |
| OMB M-26-14: Anomalous activity | Supports an activity | our analysis: beaconing and volume anomalies |
| OMB M-26-14: Attack vectors and lateral movement | Supports an activity | our analysis: east-west connections |
| NSA and ASD: Web shell detection guidance | names_source | quoted: unexpected flows from web servers; listening on previously unused ports |
| CISA: Web shell eviction countermeasure | names_source | quoted: detect unexpected network flows |
Techniques
- T1001 Data Obfuscation
- T1001.001 Junk Data
- T1001.002 Steganography
- T1001.003 Protocol or Service Impersonation
- T1008 Fallback Channels
- T1011 Exfiltration Over Other Network Medium
- T1020 Automated Exfiltration
- T1020.001 Traffic Duplication
- T1021.004 SSH
- T1021.005 VNC
- T1021.006 Windows Remote Management
- T1027.004 Compile After Delivery
- T1027.006 HTML Smuggling
- T1027.008 Stripped Payloads
- T1027.017 SVG Smuggling
- T1027.018 Invisible Unicode
- T1029 Scheduled Transfer
- T1030 Data Transfer Size Limits
- T1036.012 Browser Fingerprint
- T1041 Exfiltration Over C2 Channel
- T1046 Network Service Discovery
- T1048 Exfiltration Over Alternative Protocol
- T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol
- T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- T1056 Input Capture
- T1056.001 Keylogging
- T1056.003 Web Portal Capture
- T1059.004 Unix Shell
- T1059.008 Network Device CLI
- T1069.002 Domain Groups
- T1070.005 Network Share Connection Removal
- T1070.007 Clear Network Connection History and Configurations
- T1071 Application Layer Protocol
- T1071.001 Web Protocols
- T1071.002 File Transfer Protocols
- T1071.003 Mail Protocols
- T1071.004 DNS
- T1071.005 Publish/Subscribe Protocols
- T1072 Software Deployment Tools
- T1074.002 Remote Data Staging
- T1078 Valid Accounts
- T1080 Taint Shared Content
- T1087.002 Domain Account
- T1090 Proxy
- T1090.001 Internal Proxy
- T1090.002 External Proxy
- T1090.003 Multi-hop Proxy
- T1090.004 Domain Fronting
- T1095 Non-Application Layer Protocol
- T1102 Web Service
- T1102.001 Dead Drop Resolver
- T1102.002 Bidirectional Communication
- T1105 Ingress Tool Transfer
- T1125 Video Capture
- T1129 Shared Modules
- T1132 Data Encoding
- T1132.001 Standard Encoding
- T1132.002 Non-Standard Encoding
- T1133 External Remote Services
- T1135 Network Share Discovery
- T1136.002 Domain Account
- T1176 Software Extensions
- T1176.001 Browser Extensions
- T1176.002 IDE Extensions
- T1187 Forced Authentication
- T1189 Drive-by Compromise
- T1190 Exploit Public-Facing Application
- T1195 Supply Chain Compromise
- T1195.001 Compromise Software Dependencies and Development Tools
- T1195.002 Compromise Software Supply Chain
- T1199 Trusted Relationship
- T1200 Hardware Additions
- T1203 Exploitation for Client Execution
- T1204 User Execution
- T1204.001 Malicious Link
- T1204.003 Malicious Image
- T1204.004 Malicious Copy and Paste
- T1204.005 Malicious Library
- T1205 Traffic Signaling
- T1205.001 Port Knocking
- T1205.002 Socket Filters
- T1207 Rogue Domain Controller
- T1210 Exploitation of Remote Services
- T1212 Exploitation for Credential Access
- T1213.006 Databases
- T1219.001 IDE Tunneling
- T1219.002 Remote Desktop Software
- T1491.002 External Defacement
- T1495 Firmware Corruption
- T1496 Resource Hijacking
- T1496.001 Compute Hijacking
- T1496.002 Bandwidth Hijacking
- T1498 Network Denial of Service
- T1498.002 Reflection Amplification
- T1499.001 OS Exhaustion Flood
- T1499.002 Service Exhaustion Flood
- T1499.003 Application Exhaustion Flood
- T1499.004 Application or System Exploitation
- T1505 Server Software Component
- T1505.003 Web Shell
- T1531 Account Access Removal
- T1542.004 ROMMONkit
- T1542.005 TFTP Boot
- T1546.004 Unix Shell Configuration Modification
- T1546.018 Python Startup Hooks
- T1550 Use Alternate Authentication Material
- T1552 Unsecured Credentials
- T1556.003 Pluggable Authentication Modules
- T1556.006 Multi-Factor Authentication
- T1557 Adversary-in-the-Middle
- T1557.001 Name Resolution Poisoning and SMB Relay
- T1557.002 ARP Cache Poisoning
- T1557.003 DHCP Spoofing
- T1557.004 Evil Twin
- T1563 Remote Service Session Hijacking
- T1563.001 SSH Hijacking
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1566.003 Spearphishing via Service
- T1567 Exfiltration Over Web Service
- T1567.001 Exfiltration to Code Repository
- T1567.002 Exfiltration to Cloud Storage
- T1567.003 Exfiltration to Text Storage Sites
- T1567.004 Exfiltration Over Webhook
- T1573 Encrypted Channel
- T1573.001 Symmetric Cryptography
- T1573.002 Asymmetric Cryptography
- T1585 Establish Accounts
- T1585.001 Social Media Accounts
- T1586 Compromise Accounts
- T1586.001 Social Media Accounts
- T1589 Gather Victim Identity Information
- T1589.002 Email Addresses
- T1595 Active Scanning
- T1595.001 Scanning IP Blocks
- T1595.002 Vulnerability Scanning
- T1595.003 Wordlist Scanning
- T1598 Phishing for Information
- T1598.001 Spearphishing Service
- T1598.002 Spearphishing Attachment
- T1598.003 Spearphishing Link
- T1599 Network Boundary Bridging
- T1599.001 Network Address Translation Traversal
- T1600 Weaken Encryption
- T1600.001 Reduce Key Space
- T1600.002 Disable Crypto Hardware
- T1602 Data from Configuration Repository
- T1602.001 SNMP (MIB Dump)
- T1602.002 Network Device Configuration Dump
- T1606 Forge Web Credentials
- T1612 Build Image on Host
- T1615 Group Policy Discovery
- T1621 Multi-Factor Authentication Request Generation
- T1659 Content Injection
- T1665 Hide Infrastructure
- T1684 Social Engineering
- T1686.002 Network Device Firewall
- T1687 Exploitation for Defense Impairment
Rules
Splunk 7
Sigma 24
- DNS Events Related To Mining Pools by Saw Winn Naung, Azure-Sentinel, @neu5ron
- DNS TOR Proxies by Saw Winn Naung , Azure-Sentinel
- Default Cobalt Strike Certificate by Bhabesh Raj
- Executable from Webdav by SOC Prime, Adam Swan
- First Time Seen Remote Named Pipe - Zeek by Samir Bousseaden, @neu5ron, Tim Shelton
- HTTP Request to Low Reputation TLD or Suspicious File Extension by @signalblur, Corelight
- Katz Stealer Suspicious User-Agent by Swachchhanda Shrawan Poudel (Nextron Systems)
- Kerberos Network Traffic RC4 Ticket Encryption by sigma
- MITRE BZAR Indicators for Execution by @neu5ron, SOC Prime
- MITRE BZAR Indicators for Persistence by @neu5ron, SOC Prime
- New Kind of Network (NKN) Detection by Michael Portera (@mportatoes)
- OMIGOD HTTP No Authentication RCE - CVE-2021-38647 by Nate Guagenti (neu5ron)
- Possible Impacket SecretDump Remote Activity - Zeek by Samir Bousseaden, @neu5ron
- Possible PrintNightmare Print Driver Install - CVE-2021-1675 by @neu5ron (Nate Guagenti)
- Potential PetitPotam Attack Via EFS RPC Calls by @neu5ron, @Antonlovesdnb, Mike Remen
- Publicly Accessible RDP Service by Josh Brower @DefensiveDepth
- Remote Task Creation via ATSVC Named Pipe - Zeek by Samir Bousseaden, @neu5rn
- SMB Spoolss Name Piped Usage by OTR (Open Threat Research), @neu5ron
- Suspicious Access to Sensitive File Extensions - Zeek by Samir Bousseaden, @neu5ron
- Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network by Swachchhanda Shrawan Poudel (Nextron Systems)
- Suspicious DNS Z Flag Bit Set by @neu5ron, SOC Prime Team, Corelight
- Suspicious PsExec Execution - Zeek by Samir Bousseaden, @neu5ron, Tim Shelton
- Transferring Files with Credential Data via Network Shares - Zeek by @neu5ron, Teymur Kheirkhabarov, oscd.community
- WebDav Put Request by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Elastic 18
- Abnormally Large DNS Response
- First Seen External MQTT Broker Connection
- First Time Seen RMM Service Hostname from Network DNS
- Multiple RMM Vendors Queried by a Single DNS Client
- Newly Observed IPSEC NAT Traversal Peer
- Potential DNS Rebinding from Public to Private Address
- Potential DNS Tunneling via NULL or Long DNS Queries
- Potential cPanel WHM CRLF Authentication Bypass (CVE-2026-41940)
- RDP (Remote Desktop Protocol) from the Internet
- RPC (Remote Procedure Call) from the Internet
- RPC (Remote Procedure Call) to the Internet
- SMB (Windows File Sharing) Activity from the Internet
- SMB (Windows File Sharing) Activity to the Internet
- SMTP to the Internet on Port 26/TCP
- Splunk Enterprise PostgreSQL Backup-to-Restore Potential RCE Sequence
- Splunk Enterprise PostgreSQL Recovery Endpoint Injection Artifacts
- Web Server Cloud Metadata SSRF Request
- Web Server Potential SQL Injection Request