DocsAttack Types

Network Tunnelling & Covert Traffic

Traffic carried inside other protocols.

A VM hides traffic inside other protocols (DNS, ICMP, HTTPS) to slip past filters. Frabs looks for traffic that does not match the protocol it claims to be.

Detectors (11)

Detector	Measures	Warning	Incident	Critical
DNS Tunnelling	Tunnelling indicators (0-100) (score)	50 in 10 min	70 in 30 min	90 in 1 h
ICMP Tunnelling	Tunnelling indicators (0-100) (score)	50 in 10 min	70 in 30 min	90 in 1 h
HTTP Tunnelling	Tunnelling indicators (0-100) (score)	50 in 10 min	70 in 30 min	90 in 1 h
HTTPS Tunnelling	Tunnelling indicators (0-100) (score)	50 in 10 min	70 in 30 min	90 in 1 h
SSH Tunnelling	Tunnelling indicators (0-100) (score)	50 in 10 min	70 in 30 min	90 in 1 h
TCP Tunnelling	Tunnelling indicators (0-100) (score)	50 in 10 min	70 in 30 min	90 in 1 h
UDP Tunnelling	Tunnelling indicators (0-100) (score)	50 in 10 min	70 in 30 min	90 in 1 h
Reverse Tunnel	Tunnelling indicators (0-100) (score)	50 in 10 min	70 in 30 min	90 in 1 h
Unexpected VPN Tunnel	Tunnelling indicators (0-100) (score)	50 in 10 min	70 in 30 min	90 in 1 h
Proxy Tunnel	Tunnelling indicators (0-100) (score)	50 in 10 min	70 in 30 min	90 in 1 h
Covert Channel Behaviour	Tunnelling indicators (0-100) (score)	50 in 10 min	70 in 30 min	90 in 1 h

Change the thresholds

Use Custom Protection to change any of these, or set them for one VM. See Detectors and Thresholds.

PreviousData Exfiltration & Suspicious Transfers NextCryptocurrency & Blockchain Abuse