type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba
created: 2021-10-20T15:05:19.274Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0082
external_id: DC0082
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Network Connection Creation
description: The initial establishment of a network session, where a system or process initiates a connection to a local or remote endpoint. This typically involves capturing socket information (source/destination IP, ports, protocol) and tracking session metadata. Monitoring these events helps detect lateral movement, exfiltration, and command-and-control (C2) activities.

*Data Collection Measures:*

- Windows:
 - Event ID 5156 – Filtering Platform Connection - Logs network connections permitted by Windows Filtering Platform (WFP).
 - Sysmon Event ID 3 – Network Connection Initiated - Captures process, source/destination IP, ports, and parent process.
- Linux/macOS:
 - Netfilter (iptables), nftables logs - Tracks incoming and outgoing network connections.
 - AuditD (`connect` syscall) - Logs TCP, UDP, and ICMP connections.
 - Zeek (`conn.log`) - Captures protocol, duration, and bytes transferred.
- Cloud & Network Infrastructure:
 - AWS VPC Flow Logs / Azure NSG Flow Logs - Logs IP traffic at the network level in cloud environments.
 - Zeek (conn.log) or Suricata (network events) - Captures packet metadata for detection and correlation.
- Endpoint Detection & Response (EDR):
 - Detect anomalous network activity such as new C2 connections or data exfiltration attempts.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
mobile-attack
enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: Network Traffic
channel: None
name: AWS:VPCFlowLogs
channel: Outbound connection to 169.254.169.254 from EC2 workload
name: macos:unifiedlog
channel: connection attempts
name: esxi:hostd
channel: System service interactions
name: WinEventLog:Sysmon
channel: EventCode=3, 22
name: NSM:Connections
channel: web domain alerts
name: auditd:SYSCALL
channel: connect
name: macos:osquery
channel: process_events/socket_events
name: NSM:Firewall
channel: Outbound Connections
name: macos:unifiedlog
channel: connection open
name: auditd:SYSCALL
channel: execve: Execs of chromium, google-chrome, firefox, libreoffice with http(s) in cmdline
name: NSM:Flow
channel: New TCP/443 or TCP/80 to domain not previously seen for the user/host
name: NSM:Connections
channel: New outbound connection from Safari/Chrome/Firefox/Word
name: NSM:Flow
channel: conn.log
name: macos:osquery
channel: execution of trusted tools interacting with external endpoints
name: linux:Sysmon
channel: EventCode=3, 22
name: WinEventLog:Microsoft-Windows-Bits-Client/Operational
channel: BITS job lifecycle events such as job create/modify/transfer/complete and URL/remote name fields
name: NSM:Firewall
channel: proxy or TLS inspection logs
name: macos:unifiedlog
channel: network connection events
name: esxi:vmkernel
channel: protocol egress
name: NSM:Flow
channel: Outbound connection to *.tunnels.api.visualstudio.com or *.devtunnels.ms
name: NSM:Flow
channel: Connections to *.devtunnels.ms or tunnels.api.visualstudio.com
name: NSM:Flow
channel: HTTPs connection to tunnels.api.visualstudio.com
name: WinEventLog:Security
channel: EventCode=5156, 5157
name: linux:osquery
channel: family=AF_PACKET or protocol raw; process name not in allowlist.
name: macos:unifiedlog
channel: First outbound connection from the same PID/user shortly after an inbound trigger.
name: NSM:Flow
channel: Outbound or inbound TFTP file transfers of ROMMON or firmware binaries
name: NSM:Connections
channel: Outbound connections from newly spawned child processes or from the browser to uncommon endpoints or on anomalous ports
name: NSM:Flow
channel: connection: TCP connections to ports 139/445 to multiple hosts
name: NSM:Flow
channel: connection: SMB connections to multiple internal hosts
name: auditd:SYSCALL
channel: connect/sendto
name: macos:endpointsecurity
channel: ES_EVENT_TYPE_NOTIFY_CONNECT
name: snmp:access
channel: GETBULK/GETNEXT requests for OIDs associated with configuration parameters
name: esxi:hostd
channel: Service initiated connections
name: AWS:VPCFlowLogs
channel: Large transfer volume (>20MB) from RDS IP range to external public IPs
name: AWS:VPCFlowLogs
channel: High outbound traffic from new region resource
name: NSM:Flow
channel: Outbound HTTP/S initiated by newly installed interpreter process
name: auditd:SYSCALL
channel: open or connect syscalls on /tmp/ssh-* or $SSH_AUTH_SOCK
name: NSM:Flow
channel: outbound connections to RMM services or to unusual destination ports
name: macos:unifiedlog
channel: network sessions initiated by remote desktop apps
name: AWS:VPCFlowLogs
channel: Outbound connections to port 22, 3389
name: auditd:SYSCALL
channel: socket/connect with TLS context by unexpected process
name: NSM:Flow
channel: Multiple failed connections (conn_state=REJ/S0 or history has 'R') across distinct ports from the same src_ip followed by success to a specific port.
name: auditd:SYSCALL
channel: socket/bind: New bind() to a previously closed port shortly after the sequence.
name: NSM:Flow
channel: Sequence of REJ/S0 then SF success from same src_ip within TimeWindow.
name: NSM:Flow
channel: Series of denied/closed flows to distinct ports then success to mgmt port from same src_ip within TimeWindow.
name: NSM:Flow
channel: Outbound traffic spike through formerly blocked ports/subnets following config change
name: cni:netflow
channel: outbound connection to internal or external APIs
name: macos:osquery
channel: launchd or network_events
name: networkdevice:syslog
channel: Dynamic route changes
name: NSM:Flow
channel: New egress to Internet by the same UID/host shortly after terminal exec
name: NSM:Flow
channel: connection: Inbound connections to SSH or VPN ports
name: macos:unifiedlog
channel: Inbound connections to VNC/SSH ports
name: NSM:Flow
channel: External access to container ports (2375, 6443)
name: linux:syslog
channel: network
name: macos:osquery
channel: process_events + launchd
name: esxi:esxupdate
channel: /var/log/esxupdate.log or /var/log/vmksummary.log
name: ebpf:syscalls
channel: socket connect
name: NSM:Flow
channel: remote access
name: NSM:Flow
channel: Outbound Connections
name: macos:unifiedlog
channel: network
name: AWS:VPCFlowLogs
channel: Traffic observed on mirror destination instance
name: networkdevice:Flow
channel: Traffic from mirrored interface to mirror target IP
name: macos:osquery
channel: process_events, socket_events
name: esxi:vmkernel
channel: network activity
name: NSM:Flow
channel: connection attempts
name: NSM:Flow
channel: High-volume or repeated SNMP GETBULK/GETNEXT queries from untrusted or external IPs
name: auditd:SYSCALL
channel: sendto/connect
name: NSM:Flow
channel: outbound connections from host during or immediately after image build
name: macos:unifiedlog
channel: Outbound Traffic
name: esxi:hostd
channel: Service-Based Network Connection
name: linux:syslog
channel: postfix/smtpd
name: NSM:Flow
channel: new outbound connection from browser/office lineage
name: NSM:Flow
channel: new outbound connection from exploited lineage
name: macos:osquery
channel: CONNECT: Long-lived connections from remote-control parents to external IPs/domains
name: auditd:SYSCALL
channel: outbound connections
name: macos:unifiedlog
channel: None
name: esxi:vmkernel
channel: None
name: macos:unifiedlog
channel: networkd or socket
name: macos:unifiedlog
channel: log stream network activity
name: NSM:Flow
channel: Multiple failed connections to closed ports (history contains 'R' or conn_state in {REJ, S0}) followed by a successful handshake to a new port from same src within TimeWindowKnock
name: auditd:SYSCALL
channel: socket/bind: Process binds to a new local port shortly after knock
name: NSM:Flow
channel: Closed-port hits followed by success from same src_ip
name: NSM:Flow
channel: Port-knock pattern from one src to device unicast,broadcast,network addresses on same port within TimeWindowKnock
name: WinEventLog:Microsoft-Windows-WLAN-AutoConfig
channel: EventCode=8001, 8002, 8003
name: linux:syslog
channel: New Wi-Fi connection established or repeated association failures
name: macos:unifiedlog
channel: Association and authentication events including failures and new SSIDs
name: auditd:SYSCALL
channel: socket/connect calls showing SSH processes forwarding arbitrary ports
name: esxi:vmkernel
channel: network session initiation with external HTTPS services
name: WinEventLog:System
channel: EventCode=8001
name: linux:syslog
channel: None
name: macos:osquery
channel: None
name: auditd:SYSCALL
channel: openat,connect -k discovery
name: NSM:Flow
channel: Unexpected inbound/outbound TFTP traffic for device image files
name: NSM:Flow
channel: Unexpected or unauthorized inbound connections to SNMP, NETCONF, or RESTCONF services