Filter Network Traffic
Use network appliances to filter ingress or egress traffic and perform protocol-based filtering. Configure software on endpoints to filter network traffic.
Techniques Addressed by Mitigation
Modify network and/or host firewall rules, as well as other network controls, to only allow legitimate BITS traffic.
|Enterprise||T1522||Cloud Instance Metadata API||
Limit access to the Instance Metadata API using a host-based firewall such as iptables. A properly configured Web Application Firewall (WAF) may help prevent external adversaries from exploiting Server-side Request Forgery (SSRF) attacks that allow access to the Cloud Instance Metadata API.
|Enterprise||T1094||Custom Command and Control Protocol||
Filter network traffic to look for unusual or non-standard protocols.
|Enterprise||T1530||Data from Cloud Storage Object||
Cloud service providers support IP-based restrictions when accessing cloud resources. Consider using IP whitelisting along with user account management to ensure that data access is restricted not only to valid users but only from expected IP ranges to mitigate the use of stolen credentials to access data.
|Enterprise||T1499||Endpoint Denial of Service||
Leverage services provided by Content Delivery Networks (CDN) or providers specializing in DoS mitigations to filter traffic upstream from services. Filter boundary traffic by blocking source addresses sourcing the attack, blocking ports that are being targeted, or blocking protocols being used for transport. To defend against SYN floods, enable SYN Cookies.
|Enterprise||T1048||Exfiltration Over Alternative Protocol||
Enforce proxies and use dedicated servers for services such as DNS and only allow those systems to communicate over respective ports/protocols, instead of all systems within a network.
Block SMB traffic from exiting an enterprise network with egress filtering or by blocking TCP ports 139, 445 and UDP port 137. Filter or block WebDAV protocol traffic from exiting the network. If access to external resources over SMB and WebDAV is necessary, then traffic should be tightly limited with whitelisting.
|Enterprise||T1171||LLMNR/NBT-NS Poisoning and Relay|
Traffic to known anonymity networks and C2 infrastructure can be blocked through the use of network black and white lists. It should be noted that this kind of blocking may be circumvented by other techniques like Domain Fronting.
|Enterprise||T1498||Network Denial of Service||
When flood volumes exceed the capacity of the network connection being targeted, it is typically necessary to intercept the incoming traffic upstream to filter out the attack traffic from the legitimate traffic. Such defenses can be provided by the hosting Internet Service Provider (ISP) or by a 3rd party such as a Content Delivery Network (CDN) or providers specializing in DoS mitigations.
Depending on flood volume, on-premises filtering may be possible by blocking source addresses sourcing the attack, blocking ports that are being targeted, or blocking protocols being used for transport.
As immediate response may require rapid engagement of 3rd parties, analyze the risk associated to critical resources being affected by Network DoS attacks and create a disaster recovery plan/business continuity plan to respond to incidents.
Mitigation of some variants of this technique could be achieved through the use of stateful firewalls, depending upon how it is implemented.
|Enterprise||T1219||Remote Access Tools||
Properly configure firewalls, application firewalls, and proxies to limit outgoing traffic to sites and services used by remote access tools.
|Enterprise||T1095||Standard Non-Application Layer Protocol||
Filter network traffic to prevent use of protocols across the network boundary that are unnecessary.
|Enterprise||T1537||Transfer Data to Cloud Account||
Implement network-based filtering restrictions to prohibit data transfers to untrusted VPCs.
Cloud service providers support IP-based restrictions when accessing cloud resources. Consider using IP whitelisting on cloud-based systems along with user account management to ensure that data access is restricted not only to valid users but only from expected IP ranges to mitigate the use of stolen credentials to access data.
- Meintanis, S., Revuelto, V., Socha, K.. (2017, March 10). DDoS Overview and Response Guide. Retrieved April 24, 2019.
- US-CERT. (2017, March 16). SMB Security Best Practices. Retrieved December 21, 2017.
- US-CERT. (2017, October 20). Alert (TA17-293A): Advanced Persistent Threat Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved November 2, 2017.
- Salvati, M. (2017, June 2). Practical guide to NTLM Relaying in 2017 (A.K.A getting a foothold in under 5 minutes). Retrieved February 7, 2019.
- Kuehn, E. (2018, April 11). Ever Run a Relay? Why SMB Relays Should Be On Your Mind. Retrieved February 7, 2019.
- Microsoft. (2008, September 10). Using SMB Packet Signing. Retrieved February 7, 2019.
- Higashi, Michael. (2018, May 15). Instance Metadata API: A Modern Day Trojan Horse. Retrieved July 16, 2019.