Compliancelowstable

Cleartext Protocol Usage Via Netflow

Ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channels Ensure that an encryption is used for all sensitive information in transit. Ensure that an encrypted channels is used for all administrative account access.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Alexandr Yampolskyi, SOC PrimeCreated Tue Mar 26Updated Fri Nov 187e4bfe58-4a47-4709-828d-d86c78b7cc1fother

Log Source

netflow

Servicenetflow← raw: netflow

Detection Logic

detection:
    selection:
        destination.port:
            - 8080
            - 21
            - 80
            - 23
            - 50000
            - 1521
            - 27017
            - 1433
            - 11211
            - 3306
            - 15672
            - 5900
            - 5901
            - 5902
            - 5903
            - 5904
    condition: selection