command_and_control_pptp_point_to_point_tunneling_protocol_activity.toml

[metadata]
creation_date = "2020/02/18"
deprecation_date = "2021/04/15"
maturity = "deprecated"
updated_date = "2021/04/15"

[rule]
author = ["Elastic"]
description = """
This rule detects events that may indicate use of a PPTP VPN connection. Some threat actors use these types of
connections to tunnel their traffic while avoiding detection.
"""
false_positives = [
    """
    Some networks may utilize PPTP protocols but this is uncommon as more modern VPN technologies are available. Usage
    that is unfamiliar to local network administrators can be unexpected and suspicious. Torrenting applications may use
    this port. Because this port is in the ephemeral range, this rule may false under certain conditions, such as when
    an application server replies to a client that used this port by coincidence. This is uncommon but such servers can
    be excluded.
    """,
]
from = "now-9m"
index = ["filebeat-*", "packetbeat-*", "logs-endpoint.events.*"]
language = "kuery"
license = "Elastic License v2"
name = "PPTP (Point to Point Tunneling Protocol) Activity"
risk_score = 21
rule_id = "d2053495-8fe7-4168-b3df-dad844046be3"
severity = "low"
tags = ["Elastic", "Host", "Network", "Threat Detection", "Command and Control"]
timestamp_override = "event.ingested"
type = "query"

query = '''
event.category:(network or network_traffic) and network.transport:tcp and destination.port:1723
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[rule.threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"