outbound_ethoverip
Explanation
The outbound ethoverip NDM is designed to detect when Ethernet traffic is encapsulated within IP packets that are leaving the customer network to external destinations. Ethernet tunneling can be used for legitimate communication bridging ethernet broadcast domains across routed infrastructure. However, it can also be exploited by attackers to bypass security measures or prevent traffic from being examined.
What to Look For
If Ethernet over IP encapsulation is not expected or authorized in the environment, investigate the sources and destinations of the traffic to determine if there are any signs of malicious activity.
Related MITRE ATT&CK Categories
Updated 13 days ago