Cleartext Protocol Traffic on Netflow Ports Indicative of Credential Exposure

title: Cleartext Protocol Traffic on Netflow Ports Indicative of Credential Exposure
id: 54c23729-5445-41b9-81c5-965c67404665
status: stable
description: This rule flags network flows observed in Netflow that target a set of commonly used service ports associated with cleartext protocols. Attackers can use these channels to capture usernames and authentication data if sessions are not encrypted in transit. The detection relies on Netflow telemetry that records destination ports for inbound connections matching the listed values.
references:
  - https://www.cisecurity.org/controls/cis-controls-list/
  - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
  - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-compliance/other/netflow_cleartext_protocols.yml
author: Alexandr Yampolskyi, SOC Prime, Huntrule Team
date: 2019-03-26
modified: 2022-11-18
tags:
  - attack.credential-access
logsource:
  service: netflow
detection:
  selection:
    destination.port:
      - 8080
      - 21
      - 80
      - 23
      - 50000
      - 1521
      - 27017
      - 1433
      - 11211
      - 3306
      - 15672
      - 5900
      - 5901
      - 5902
      - 5903
      - 5904
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 7e4bfe58-4a47-4709-828d-d86c78b7cc1f
    type: derived