Network sniffing detected in Cloud environment

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-09-24

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	5 Days
Required Data	Requires one of the following data sources: AWS Audit Log OR Azure Audit Log OR Gcp Audit Log
Detection Modules	Cloud
Detector Tags
ATT&CK Tactic	Credential Access (TA0006) Discovery (TA0007)
ATT&CK Technique	Network Sniffing (T1040)
Severity	Informational

Network sniffing tool was used in cloud environment.

Adversaries may sniff network traffic to capture information about an environment, including authentication material passed over the network.

ATT&CK Tactic

ATT&CK Technique

Severity

Low

Network sniffing tool was used in cloud environment.

Adversaries may sniff network traffic to capture information about an environment, including authentication material passed over the network.

ATT&CK Tactic

ATT&CK Technique

Severity

Informational

Network sniffing tool was used in cloud environment.

Adversaries may sniff network traffic to capture information about an environment, including authentication material passed over the network.