Analytics BIOC
Informational
✕
Network sniffing detected in Cloud environment
A network sniffing tool was used in a cloud environment.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- AWS Audit Log, Azure Audit Log, Gcp Audit Log
ATT&CK tactics: Credential Access (TA0006) Discovery (TA0007)
ATT&CK techniques: Network Sniffing (T1040)
Attacker's goals:
Adversaries may sniff network traffic to capture information about an environment, including authentication material passed over the network.
Investigative actions:
Check the targeted resources and the sniffing policy. Check The cloud identity activity prior/after the network sniffing.
- Test period:
- N/A (single event)
- Deduplication:
- 5 Days
2 variations:
- Unusual Network sniffing detected in Cloud environment Low (parent: Informational)
- Successful Network sniffing detected in Cloud environment Informational