Traffic Duplication (T1020.001) is a sub-technique of Automated Exfiltration. Adversaries abuse traffic mirroring to automate exfiltration over compromised infrastructure. MITRE lists network devices and IaaS.
How attackers use it
Traffic mirroring is a native feature on some devices, normally used to send traffic to a network analyzer. MITRE says adversaries can abuse it to copy or redirect traffic through infrastructure they control. On network devices, malicious changes to enable it may come through ROMMONkit or by patching the system image. In the cloud, AWS Traffic Mirroring, GCP Packet Mirroring and Azure vTap let users pick the instances to collect from and a target for the copy. MITRE adds that duplication may be paired with network sniffing, input capture or adversary-in-the-middle activity.
How to detect it
MITRE's analytic is in two parts:
- In IaaS, configuration changes to virtual TAP or mirror policies that send traffic to unapproved destinations. Correlate management plane API calls with mirrored traffic.
- On routers and switches, unauthorized mirroring sessions, such as a monitor session or mirror port, along with outbound traffic from the mirrored interface to unexpected destinations.
Practical sources are cloud audit logs of API calls for mirror sessions, filters and targets, and configuration backups or change tracking on network devices. Alert on any new mirror session that is not tied to an approved change.
How to reduce the risk
MITRE lists:
- Encrypt Sensitive Information: encrypt wired and wireless traffic appropriately, use strong authentication protocols such as Kerberos, and protect web traffic that may hold credentials with TLS.
- User Account Management: in cloud environments, do not grant permission to create or modify traffic mirrors unless it is explicitly required.
- Data Loss Prevention: monitor, detect and control the flow of sensitive information.
Check your own environment
- Who holds permission to create mirror sessions in your cloud accounts? Review the roles.
- Are mirror sessions recorded in your audit logs, and does an alert exist for new ones?
- Are network device configurations backed up and compared on a schedule?
The demo below shows how connecting cloud accounts surfaces configuration across your environment.
Click through it at your own pace, or open it full screen.
Quick check
Which cloud permission matters most for this technique?
The ability to create or modify traffic mirrors. MITRE advises not granting it unless explicitly required.
