NF - ISAKMP VPN Connection setup from host to outbound destination - Windows 7 SP2 - Windows Server 2008 / 2008 R2

NF – ISAKMP VPN Connection setup from host to outbound destination – Windows 7 SP2 – Windows Server 2008 / 2008 R2

The rule detects ISAKMP VPN connection setups originating from the internal network to an outbound destination (EXTERNAL_NET), with a specific ISAKMP Initiator cookie value (00 00 00 08). The rule is intended to provide visibility into ISAKMP VPN connection attempts, particularly those related to Windows 7 SP2 - Windows Server 2008 / 2008 R2 hosts, and assist in monitoring and securing VPN communication in the network.

Categories:

ID Number

5027206

Signature

alert udp $HOME_NET 500 -> $EXTERNAL_NET 500 (msg:"NF - ISAKMP VPN Connection setup from host to outbound destination - Windows 7 SP2 - Windows Server 2008 / 2008 R2"; content:"|00 00 00 08|"; reference:url,networkforensic.dk; metadata:29112018; classtype:policy-violation; sid:5027206; rev:1;)

MITRE ATT&CK Technique

Severity

Medium

Recommendations/Investigative actions

Authorize the connection. If the connection was approved as a network engineer accessing the PLC - archive and baseline the rule. If not - check the connection and investigate the relevant IP address.