NF - ISAKMP VPN Connection setup from host to outbound destination - Windows XP

NF – ISAKMP VPN Connection setup from host to outbound destination – Windows XP

The rule detects ISAKMP VPN connection setups originating from the internal network to an outbound destination (EXTERNAL_NET), with a specific ISAKMP Initiator cookie value (00 00 00 03). The rule is intended to provide visibility into ISAKMP VPN connection attempts, particularly those related to Windows XP hosts, and assist in monitoring and securing VPN communication in the network.

Categories:

ID Number

5027202

Signature

alert udp $HOME_NET 500 -> $EXTERNAL_NET 500 (msg:"NF - ISAKMP VPN Connection setup from host to outbound destination - Windows XP"; content:"|00 00 00 03|"; reference:url,networkforensic.dk; metadata:29112018; classtype:policy-violation; sid:5027202; rev:1;)

MITRE ATT&CK Technique

Severity

Medium

Recommendations/Investigative actions

Authorize the connection. If the connection was approved as a network engineer accessing the PLC - archive and baseline the rule. If not - check the connection and investigate the relevant IP address.