Sunturai
Back to results
MediumSplunk security contentMikael Bjerkeland +1

Detect IPv6 Network Infrastructure Threats

The following analytic detects IPv6 network infrastructure threats by identifying suspicious activities such as IP and MAC address theft or packet drops. It leverages logs from Cisco network devices configured with…

Description

The following analytic detects IPv6 network infrastructure threats by identifying suspicious activities such as IP and MAC address theft or packet drops. It leverages logs from Cisco network devices configured with First Hop Security measures like RA Guard and DHCP Guard. This activity is significant as it can indicate attempts to compromise network integrity and security. If confirmed malicious, attackers could manipulate network traffic, leading to potential data interception, unauthorized access, or network disruption.

Detection logic

Detection requirements

Platform
ContainersIaaSLinuxmacOSWindows

The rule states no platform. This is derived from the 3 ATT&CK techniques it maps to.

Log source category
cisco_ios_logs

Known benign triggers

  • No false positives have been identified at this time.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice