SDF-DT06

Network Flow Surveillance

intermediateDetection Value: highCost: moderateTime: 3-7 days🔗 Network Infrastructure

Description

Monitor network traffic flows to and from deception infrastructure to detect adversary communication patterns, data exfiltration attempts, and command-and-control channels established through deception assets.

Rationale

Network-level monitoring of deception infrastructure captures adversary activity that host-level monitoring might miss. This includes encrypted communications, lateral movement attempts, data staging and exfiltration, and command-and-control beaconing patterns that provide insight into adversary infrastructure and operational security.

Supporting Basis

Direct antecedent

The sources capture and monitor network activity associated with deceptive systems and services.

These sources establish design lineage and scope. They do not validate this record's operational effectiveness, planning estimates, environment labels, or ATT&CK relationships.

Implementation Steps

Deploy network sensors

Position network monitoring sensors on all segments carrying deception traffic. Configure for both flow metadata and full packet capture on key segments.

Configure flow analysis

Set up flow analysis tools to detect beaconing patterns, unusual protocol usage, large data transfers, and connections to external infrastructure.

Enable protocol inspection

Deploy deep packet inspection for unencrypted protocols to capture adversary commands and data transfers in detail.

Monitor egress traffic

Pay special attention to outbound traffic from deception assets, as this may indicate adversary attempt to exfiltrate data or establish external command-and-control.

Technical Implementation Examples(1)

Zeek Script for Deception Network Monitoring

Zeek (formerly Bro) script to monitor and log all connections to deception network segments

zeek

# shadow-cdf-monitor.zeek
# Monitor all connections to/from deception network segments.
# Deploy on a network tap or SPAN port covering deception traffic.

module ShadowCDF;

export {
    # Define deception network ranges
    const deception_nets: set[subnet] = {
        10.200.10.0/24,   # Web tier decoys
        10.200.20.0/24,   # App tier decoys
        10.200.30.0/24,   # DB tier decoys
        10.200.40.0/24,   # Admin decoys
    } &redef;

    # Management subnet (exclude from alerts)
    const mgmt_nets: set[subnet] = {
        10.200.99.0/24,
    } &redef;

    # Custom log stream for deception interactions
    redef enum Log::ID += { LOG };

    type Info: record {
        ts:          time    &log;
        uid:         string  &log;
        src_ip:      addr    &log;
        src_port:    port    &log;
        dst_ip:      addr    &log;
        dst_port:    port    &log;
        proto:       string  &log;
        service:     string  &log &optional;
        duration:    interval &log &optional;
        orig_bytes:  count   &log &optional;
        resp_bytes:  count   &log &optional;
        alert_type:  string  &log;
    };
}

event zeek_init() {
    Log::create_stream(ShadowCDF::LOG,
        [$columns=Info, $path="shadow-cdf"]);
}

event connection_state_remove(c: connection) {
    local src = c$id$orig_h;
    local dst = c$id$resp_h;

    # Check if connection involves deception infrastructure
    if (dst !in deception_nets && src !in deception_nets)
        return;

    # Exclude management traffic
    if (src in mgmt_nets || dst in mgmt_nets)
        return;

    local alert_type = "inbound";
    if (src in deception_nets)
        alert_type = "outbound_from_decoy";  # Adversary C2?

    local rec: Info = [
        $ts = c$start_time,
        $uid = c$uid,
        $src_ip = src,
        $src_port = c$id$orig_p,
        $dst_ip = dst,
        $dst_port = c$id$resp_p,
        $proto = cat(c$id$resp_p),
        $alert_type = alert_type
    ];

    if (c?$service)
        rec$service = c$service;
    if (c?$duration)
        rec$duration = c$duration;

    Log::write(ShadowCDF::LOG, rec);
}

MITRE ATT&CK Mappings

Technique	Tactic	Relationship
T1071Application Layer Protocol	Command and Control	detects
T1048Exfiltration Over Alternative Protocol	Exfiltration	detects

Considerations

Egress monitoring is critical. Any outbound connection from a deception asset that was not initiated by monitoring infrastructure indicates adversary-initiated communication.
Capture DNS queries from deception assets. Adversary tools often perform DNS lookups that reveal their infrastructure or tunneling attempts.
Consider the encrypted traffic challenge. While you cannot inspect encrypted content, you can analyze connection patterns, certificate details, and JA3 fingerprints.

Supported Environments

🏢On-Premise

☁Amazon Web Services

☁Microsoft Azure

☁Google Cloud Platform

🔄Hybrid Environment

🏭OT/ICS Environment

Tools & Resources

Zeek network analyzer
Suricata IDS/IPS
Network flow collectors (NetFlow, sFlow)
Full packet capture systems

Related Techniques

SDF-DT01Interaction Tripwire Monitoring

SDF-DT04Access Pattern Anomaly Detection

Quick Stats

Phase: Detect
Difficulty: intermediate
Detection Value: high
Cost: moderate
Time: 3-7 days
ATT&CK Mappings: 2