Analytics BIOC Informational

Network sniffing detected in Cloud environment

A network sniffing tool was used in a cloud environment.

Module:
Cortex Cloud
Licensed by:
Cloud Runtime Security (CRS)
Data source:
AWS Audit Log, Azure Audit Log, Gcp Audit Log
ATT&CK tactics: Credential Access (TA0006) Discovery (TA0007)
ATT&CK techniques: Network Sniffing (T1040)
Attacker's goals:

Adversaries may sniff network traffic to capture information about an environment, including authentication material passed over the network.

Investigative actions:

Check the targeted resources and the sniffing policy. Check The cloud identity activity prior/after the network sniffing.

Test period:
N/A (single event)
Deduplication:
5 Days
2 variations:
  • Unusual Network sniffing detected in Cloud environment Low (parent: Informational)
  • Successful Network sniffing detected in Cloud environment Informational