T1020.001 — Traffic Duplication

Tactic: Exfiltration · Platforms: Network Devices, IaaS

Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure. Traffic mirroring is a native feature for some devices, often used for network analysis. For example, devices may be configured to forward network traffic to one or more destinations…

Sub-technique of Automated Exfiltration (T1020).

Sigma detection rules (2)

T1020.001 Automated Exfiltration: Traffic Duplication

title: "T1020.001 Automated Exfiltration: Traffic Duplication"
id: 4354cdbe-172d-4bb2-88a1-dc1f500b6234
description: 'Detection Strategy for Traffic Duplication via Mirroring in IaaS and Network Devices. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TimeWindow, MirrorDestinationCIDR, UserIdentity.'
references:
  - https://attack.mitre.org/techniques/T1020/001
author: Shahrukh Khan
date: 2026-06-16
license: MIT
tags:
  - attack.exfiltration
  - attack.t1020.001

logsource:
  category: cloudtrail
  product: aws

detection:
  selection_mirror_create:
    eventSource: 'ec2.amazonaws.com'
    eventName:
      - 'CreateTrafficMirrorTarget'
      - 'CreateTrafficMirrorFilter'
      - 'CreateTrafficMirrorSession'
      - 'CreateTrafficMirrorFilterRule'

  condition: selection_mirror_create

falsepositives:
  - Legitimate network security teams do use VPC Traffic Mirroring for IDS or packet capture tooling, so validate against a known change ticket before escalating.

level: high

T1020.001 Automated Exfiltration: Traffic Duplication

title: "T1020.001 Automated Exfiltration: Traffic Duplication"
id: 3e3e21b4-7129-46f7-914b-250ccd219f8f
description: 'Detection Strategy for Traffic Duplication via Mirroring in IaaS and Network Devices. Filtering SYSCALL connect events by exe containing tcpdump/socat/tshark was inconsistent: tcpdump and tshark are passive packet captures that typically use raw/AF_PACKET sockets rather than issuing a connect() syscall, so only socat (used for actively forwarding mirrored traffic) plausibly matched the connect() filter. Split into a connect()-scoped selection for socat and a separate process_creation selection for tcpdump/tshark invocation itself, since their actual auditd-observable signal is process launch, not a connect syscall. (Data Component: Network Traffic Flow; baseline tier: fallback.) Tune using: ConfigChangeType, MirrorDestinationPort, DeviceRole.'
references:
  - https://attack.mitre.org/techniques/T1020/001
author: Shahrukh Khan
date: 2026-03-08
license: MIT
tags:
  - attack.exfiltration
  - attack.t1020.001

logsource:
  category: network_connection
  product: linux
  service: auditd

detection:
  selection_socat_connect:
    type: SYSCALL
    syscall: connect
    exe|contains: '/socat'
  selection_capture_exec:
    type: EXECVE
    a0|endswith:
      - '/tcpdump'
      - '/tshark'

  condition: 1 of selection_*

falsepositives:
  - Network engineers and packet capture tooling legitimately run tcpdump/tshark for troubleshooting, or socat for legitimate traffic relaying; auditd telemetry cannot distinguish a benign capture/relay from an attacker duplicating traffic to an exfiltration destination.

level: medium

Explore