TA0010 · EXFILTRATION
Traffic Duplication
Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure. Traffic mirroring is a native feature for some devices, often used for network analysis.
Detect it with
Monitor network traffic for uncommon data flows (e.g. unusual network communications, suspicious communications that have never been seen before, communications sending fixed size data packets at regular intervals).
Why it matters on shift
Traffic Duplication is one of the concrete ways adversaries achieve exfiltration. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After exfiltration, the next tactic is usually Impact. Search your telemetry for the transition before closing the ticket.
Kill-chain context