Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-CloudTrafficMirroring-Exfil.
Upgrade to ProDetect Cross-Account/Cross-Tenant Cloud Traffic Mirror Target Redirection for Passive Exfiltration in Google Chronicle
The base T1020.001 technique detection alerts on any creation, modification, or deletion of an AWS Traffic Mirroring, Azure Virtual Network TAP, or GCP Packet Mirroring resource — a necessarily broad signal that fires just as often on legitimate NDR/IDS sensor deployments as it does on adversary activity, since the API calls themselves are identical in both cases. THREAT-NetworkTap-RogueSPANExfil.json separately covers the on-premises SPAN/RSPAN/ERSPAN control-plane equivalent for physical network devices. This scenario targets a materially different and higher-fidelity signal that neither file covers: the account, subscription, or project boundary that the mirrored traffic crosses to reach its collector. All three cloud providers support pointing a traffic mirror/vTAP/packet-mirroring destination at a collector that lives in a different AWS account, Azure subscription, or GCP project than the one being mirrored — a legitimate pattern for centralized security-tooling accounts reached over Transit Gateway, VPC peering, or Shared VPC, but also the exact mechanism an adversary with compromised cloud credentials would use to redirect duplicated production traffic to infrastructure they own outside the victim's security boundary, where it is invisible to the victim's own logging, IAM, and network controls once the copy leaves the account. A cross-account/cross-project mirror target is not inherently malicious (it is how MDR and NDR vendors are legitimately onboarded), so this scenario correlates it with the second-order signal that made it possible: a newly established cross-account network path (VPC peering acceptance, Transit Gateway attachment, AWS RAM resource share, or a first-seen destination subscription/project for a given source) created shortly before the mirror session — a pairing that is rare for sanctioned architectures (provisioned once, well in advance, via IaC) but characteristic of an attacker standing up exfiltration infrastructure end-to-end in a single compromised session.
MITRE ATT&CK
- Tactic
- Exfiltration
YARA-L Detection Query
rule cross_boundary_traffic_mirror_target {
meta:
author = "df00tech"
description = "Detects cloud traffic mirroring, vTAP, or packet mirroring resources whose destination collector resolves to a different cloud account, subscription, or project than the source being mirrored"
severity = "HIGH"
mitre_attack_tactic = "Exfiltration"
mitre_attack_technique = "T1020.001"
reference = "https://attack.mitre.org/techniques/T1020/001/"
events:
(
re.regex($e.metadata.product_event_type, `(?i)CreateTrafficMirrorTarget|CreateTrafficMirrorSession|insertPacketMirroring|patchPacketMirroring`)
or re.regex($e.target.resource.name, `(?i)virtualNetworkTaps`)
)
and $e.principal.cloud.project.id != $e.target.cloud.project.id
condition:
$e
}Chronicle YARA-L 2.0 rule matching UDM events for traffic mirror/vTAP/packet mirroring creation where the normalized principal.cloud.project.id (the calling account/subscription/project) differs from target.cloud.project.id (the destination collector's account/subscription/project). Requires the Chronicle ingestion pipeline to populate both cloud.project.id fields from the respective provider's audit log schema (CloudTrail recipientAccountId vs. target ARN account, Azure subscription GUIDs, or GCP project IDs).
Data Sources
Required Tables
False Positives & Tuning
- Approved cross-boundary security-tooling architectures documented in the organization's landing zone design
- MDR/NDR vendor onboarding with a signed data processing agreement covering the destination account/subscription/project
- Authorised red team or penetration test engagements with documented scope including cross-account traffic mirroring as a tested technique
Other platforms for THREAT-CloudTrafficMirroring-Exfil
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1AWS Cross-Account Traffic Mirror Target via Peered VPC
Expected signal: AWS CloudTrail logs AcceptVpcPeeringConnection followed by CreateTrafficMirrorTarget and CreateTrafficMirrorSession events from the same userIdentity.arn within minutes, each with recipientAccountId set to the victim account and, for the mirror target event, a responseElements.trafficMirrorTarget.networkLoadBalancerArn containing the attacker account ID (999999999999).
- Test 2Azure vTAP Destination NIC in a Different Subscription
Expected signal: Azure Activity Log records Microsoft.Network/virtualNetworkTaps/write with the destination field referencing a resource ID whose subscription GUID (ATTACKER_SUBSCRIPTION_ID) differs from the calling subscription, followed by Microsoft.Network/networkInterfaces/tapConfigurations/write for the source NIC attachment.
- Test 3GCP Packet Mirroring Collector in a Different Project via Shared VPC
Expected signal: GCP Cloud Audit Log records a compute.packetMirrorings.insert method call in the victim-service-project's Admin Activity log, with the request body's collectorIlb self-link referencing attacker-project — a different project ID than either the calling project or the mirrored subnetwork's host project (victim-host-project).
- Test 4AWS RAM Resource Share Immediately Followed by Cross-Account Mirror Session
Expected signal: AWS CloudTrail logs AssociateResourceShare (principal 999999999999) followed within minutes by CreateTrafficMirrorSession, both attributed to the same userIdentity.arn and recipientAccountId (123456789012).
References (8)
- https://attack.mitre.org/techniques/T1020/001/
- https://docs.aws.amazon.com/vpc/latest/mirroring/traffic-mirroring-considerations.html
- https://docs.aws.amazon.com/vpc/latest/mirroring/traffic-mirroring-target.html
- https://docs.aws.amazon.com/ram/latest/userguide/what-is.html
- https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html
- https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-tap-overview
- https://cloud.google.com/vpc/docs/packet-mirroring
- https://cloud.google.com/vpc/docs/shared-vpc
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-CloudTrafficMirroring-Exfil — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.