Unexpected UDP Traffic

Description

Detecting UDP traffic on ports other than 53 (DNS) or other commonly used ports. Misusing UDP is a known TTP among attackers. Monitoring unusual network activity is highly valuable but often generates significant noise, as is the case with this detection.

Query · falco

inbound_outbound and fd.l4proto=udp and not expected_udp_traffic

Rule dependencies

Depends on

  • composes · Falco macro expected_udp_traffic
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro inbound_outbound
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Unexpected UDP Traffic Seen | connection=%fd.name lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Unexpected UDP Traffic · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Unexpected UDP Traffic
desc: 'Detecting UDP traffic on ports other than 53 (DNS) or other commonly used ports.
  Misusing UDP is a known TTP among attackers. Monitoring unusual network activity
  is highly valuable but often generates significant noise, as is the case with this
  detection.

  '
condition: 'inbound_outbound and fd.l4proto=udp and not expected_udp_traffic

  '
output: Unexpected UDP Traffic Seen | connection=%fd.name lport=%fd.lport rport=%fd.rport
  fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid
  user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname
  command=%proc.cmdline terminal=%proc.tty
priority: NOTICE
tags:
- maturity_incubating
- host
- container
- network
- mitre_exfiltration
- TA0011

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.