Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-CloudTrafficMirroring-Exfil.
Upgrade to ProDetect Cross-Account/Cross-Tenant Cloud Traffic Mirror Target Redirection for Passive Exfiltration in IBM QRadar
The base T1020.001 technique detection alerts on any creation, modification, or deletion of an AWS Traffic Mirroring, Azure Virtual Network TAP, or GCP Packet Mirroring resource — a necessarily broad signal that fires just as often on legitimate NDR/IDS sensor deployments as it does on adversary activity, since the API calls themselves are identical in both cases. THREAT-NetworkTap-RogueSPANExfil.json separately covers the on-premises SPAN/RSPAN/ERSPAN control-plane equivalent for physical network devices. This scenario targets a materially different and higher-fidelity signal that neither file covers: the account, subscription, or project boundary that the mirrored traffic crosses to reach its collector. All three cloud providers support pointing a traffic mirror/vTAP/packet-mirroring destination at a collector that lives in a different AWS account, Azure subscription, or GCP project than the one being mirrored — a legitimate pattern for centralized security-tooling accounts reached over Transit Gateway, VPC peering, or Shared VPC, but also the exact mechanism an adversary with compromised cloud credentials would use to redirect duplicated production traffic to infrastructure they own outside the victim's security boundary, where it is invisible to the victim's own logging, IAM, and network controls once the copy leaves the account. A cross-account/cross-project mirror target is not inherently malicious (it is how MDR and NDR vendors are legitimately onboarded), so this scenario correlates it with the second-order signal that made it possible: a newly established cross-account network path (VPC peering acceptance, Transit Gateway attachment, AWS RAM resource share, or a first-seen destination subscription/project for a given source) created shortly before the mirror session — a pairing that is rare for sanctioned architectures (provisioned once, well in advance, via IaC) but characteristic of an attacker standing up exfiltration infrastructure end-to-end in a single compromised session.
MITRE ATT&CK
- Tactic
- Exfiltration
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
LOGSOURCENAME(logsourceid) AS LogSource,
"Actor Principal Email" AS Actor,
"Caller IP" AS SourceIP,
"Mirrored Subnetwork Project ID" AS SourceProjectId,
"Collector Forwarding Rule Project ID" AS CollectorProjectId,
"EventName"
FROM events
WHERE LOGSOURCETYPENAME(devicetype) = 'Google GCP Audit'
AND (LOWER("EventName") LIKE '%packetmirrorings.insert%' OR LOWER("EventName") LIKE '%packetmirrorings.patch%')
AND "Mirrored Subnetwork Project ID" <> "Collector Forwarding Rule Project ID"
ORDER BY starttime DESC
LAST 7 DAYSQRadar AQL query flagging GCP Packet Mirroring creation/modification events where the mirrored subnetwork's owning project (parsed via a QRadar Custom Event Property from the mirroredResources.subnetworks self-link) differs from the collector forwarding rule's owning project (parsed via a Custom Event Property from the collectorIlb self-link) — indicating a Shared VPC mirror routed to a collector outside the host project's boundary.
Data Sources
Required Tables
False Positives & Tuning
- Approved Shared VPC architectures where the security/network host project intentionally routes mirrored traffic to a dedicated inspection project's ILB
- CSPM or compliance automation enumerating packet mirroring policies across projects during scheduled posture assessments
- Multi-project NDR vendor deployments where the collector project is a documented, vendor-managed GCP project
Other platforms for THREAT-CloudTrafficMirroring-Exfil
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1AWS Cross-Account Traffic Mirror Target via Peered VPC
Expected signal: AWS CloudTrail logs AcceptVpcPeeringConnection followed by CreateTrafficMirrorTarget and CreateTrafficMirrorSession events from the same userIdentity.arn within minutes, each with recipientAccountId set to the victim account and, for the mirror target event, a responseElements.trafficMirrorTarget.networkLoadBalancerArn containing the attacker account ID (999999999999).
- Test 2Azure vTAP Destination NIC in a Different Subscription
Expected signal: Azure Activity Log records Microsoft.Network/virtualNetworkTaps/write with the destination field referencing a resource ID whose subscription GUID (ATTACKER_SUBSCRIPTION_ID) differs from the calling subscription, followed by Microsoft.Network/networkInterfaces/tapConfigurations/write for the source NIC attachment.
- Test 3GCP Packet Mirroring Collector in a Different Project via Shared VPC
Expected signal: GCP Cloud Audit Log records a compute.packetMirrorings.insert method call in the victim-service-project's Admin Activity log, with the request body's collectorIlb self-link referencing attacker-project — a different project ID than either the calling project or the mirrored subnetwork's host project (victim-host-project).
- Test 4AWS RAM Resource Share Immediately Followed by Cross-Account Mirror Session
Expected signal: AWS CloudTrail logs AssociateResourceShare (principal 999999999999) followed within minutes by CreateTrafficMirrorSession, both attributed to the same userIdentity.arn and recipientAccountId (123456789012).
References (8)
- https://attack.mitre.org/techniques/T1020/001/
- https://docs.aws.amazon.com/vpc/latest/mirroring/traffic-mirroring-considerations.html
- https://docs.aws.amazon.com/vpc/latest/mirroring/traffic-mirroring-target.html
- https://docs.aws.amazon.com/ram/latest/userguide/what-is.html
- https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html
- https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-tap-overview
- https://cloud.google.com/vpc/docs/packet-mirroring
- https://cloud.google.com/vpc/docs/shared-vpc
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-CloudTrafficMirroring-Exfil — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.