Elastic medium stable eql

Potential Traffic Tunneling using QEMU

Identifies the use of the QEMU hardware emulator to potentially tunnel network traffic between Virtual machines. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination.

View Source

Detection Logic

process where event.type == "start" and
 process.args : "-netdev" and
 (
  (process.args : "-nographic" and process.command_line : "*connect=*" and process.command_line : "*restrict=off*") or
   process.command_line : "*hostfwd=*"
 )

Field Validations

Loading…

Comments (0)

Loading comments...