NF - ISAKMP VPN Connection setup from host to outbound destination - Windows 2000

NF – ISAKMP VPN Connection setup from host to outbound destination – Windows 2000

The rule detects ISAKMP VPN connection setups originating from the internal network to an outbound destination (EXTERNAL_NET), with a specific ISAKMP Initiator cookie value (00 00 00 02). The rule is intended to provide visibility into ISAKMP VPN connection attempts, particularly those related to Windows 2000 hosts, and assist in monitoring and securing VPN communication in the network.

Categories:

ID Number

5027201

Signature

alert udp $HOME_NET 500 -> $EXTERNAL_NET 500 (msg:"NF - ISAKMP VPN Connection setup from host to outbound destination - Windows 2000"; content:"|00 00 00 02|"; reference:url,networkforensic.dk; metadata:29112018; classtype:policy-violation; sid:5027201; rev:1;)

MITRE ATT&CK Technique

Severity

Medium

Recommendations/Investigative actions

Authorize the connection. If the connection was approved as a network engineer accessing the PLC - archive and baseline the rule. If not - check the connection and investigate the relevant IP address.