Cleartext Authentication via Netflow to Common Service Ports
Alerts on Netflow flows to specific service ports that may indicate cleartext protocol use and potential credential exposure.
FreeReviewedSigma · Low · v5
- Service
- netflow
- Author
- Alexandr Yampolskyi, SOC Prime (SigmaHQ), DRL 1.1
- Published
- 2019-03-26
- Updated
- 2026-07-31
What it detects
This rule flags network traffic observed in Netflow where the destination port matches a set of commonly used services that often host authentication or administrative access. Cleartext protocol use on these ports can expose usernames and authentication credentials to interception and credential replay. It relies on Netflow telemetry for destination port values to identify potentially unencrypted in-transit sessions.
Reporting behind it
- cisecurity.orghttps://www.cisecurity.org/controls/cis-controls-list/
- pcisecuritystandards.orghttps://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
- nvlpubs.nist.govhttps://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-compliance/other/netflow_cleartext_protocols.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
cleartext-protocol-traffic-on-netflow-ports-indicative-of-credential-exposure-7e4bfe58
title: Cleartext Authentication via Netflow to Common Service Ports
id: 54c23729-5445-41b9-81c5-965c67404665
status: stable
description: This rule flags network traffic observed in Netflow where the destination port matches a set of commonly used services that often host authentication or administrative access. Cleartext protocol use on these ports can expose usernames and authentication credentials to interception and credential replay. It relies on Netflow telemetry for destination port values to identify potentially unencrypted in-transit sessions.
references:
- https://www.cisecurity.org/controls/cis-controls-list/
- https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
- https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules-compliance/other/netflow_cleartext_protocols.yml
author: Alexandr Yampolskyi, SOC Prime, Huntrule Team
date: 2019-03-26
modified: 2022-11-18
tags:
- attack.credential-access
logsource:
service: netflow
detection:
selection:
destination.port:
- 8080
- 21
- 80
- 23
- 50000
- 1521
- 27017
- 1433
- 11211
- 3306
- 15672
- 5900
- 5901
- 5902
- 5903
- 5904
condition: selection
falsepositives:
- Unknown
level: low
license: DRL-1.1
related:
- id: 7e4bfe58-4a47-4709-828d-d86c78b7cc1f
type: derived