← Library
kqlElastic-2.0from elastic/detection-rules

IPSEC NAT Traversal Port Activity

Quality
92
FP risk
—
Forks
0
Views
0
ATT&CK techniques
T1095T1572T1573
Rule sourcerules/network/command_and_control_nat_traversal_port_activity.toml
(data_stream.dataset: network_traffic.flow or (event.category: (network or network_traffic))) and network.transport:udp and destination.port:4500