Synopsis
Activation Period |
14 Days |
Training Period |
30 Days |
Test Period |
N/A (single event) |
Deduplication Period |
1 Day |
Required Data |
|
Detection Modules |
|
Detector Tags |
|
ATT&CK Tactic |
|
ATT&CK Technique |
|
Severity |
Informational |
Description
The host produced traffic consistent with the BitTorrent protocol.
Torrent usage may expose the organization to malware or enable attackers or malicious insiders to exfiltrate data.
Attacker's Goals
Exfiltrate data or as a phishing entry point.
Investigative actions
- Check the host for torrent client software.
- Look at the download's folder for foreign files or Torrent files.
- Examine the client's network traffic for uploaded or downloaded file hashes.