NF - ISAKMP VPN Connection setup from host to outbound destination - Windows Vista

NF – ISAKMP VPN Connection setup from host to outbound destination – Windows Vista

The rule detects ISAKMP VPN connection setups originating from the internal network to an outbound destination (EXTERNAL_NET), with a specific ISAKMP Initiator cookie value (00 00 00 05). The rule is intended to provide visibility into ISAKMP VPN connection attempts, particularly those related to Windows Vista hosts, and assist in monitoring and securing VPN communication in the network.

Categories:

ID Number

5027204

Signature

alert udp $HOME_NET 500 -> $EXTERNAL_NET 500 (msg:"NF - ISAKMP VPN Connection setup from host to outbound destination - Windows Vista"; content:"|00 00 00 05|"; reference:url,networkforensic.dk; metadata:29112018; classtype:policy-violation; sid:5027204; rev:1;)

MITRE ATT&CK Technique

Severity

Medium

Recommendations/Investigative actions

Authorize the connection. If the connection was approved as a network engineer accessing the PLC - archive and baseline the rule. If not - check the connection and investigate the relevant IP address.