Download pattern that resembles Peer to Peer traffic

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	30 Minutes
Deduplication Period	1 Day
Required Data	Requires one of the following data sources: Palo Alto Networks Firewall traffic Logs OR XDR Agent
ATT&CK Tactic	Command and Control (TA0011), Initial Access (TA0001)
ATT&CK Technique	Application Layer Protocol (T1071), Non-Standard Port (T1571), Trusted Relationship (T1199), Phishing (T1566)
Severity	Informational

Description

A possible P2P protocol was spotted from an internal host.

Attacker's Goals

An attacker may use peer-to-peer communication to gain initial access, as a C&C tool, or an exfiltration tool.

Investigative actions

• confirm that the port accessed is a P2P port/ is run by a P2P application.
• View the downloaded content and determine it's not malicious.
• Check for large uploads from this host and check for sensitive information that might not be required on the host.