Potential SIP Extension Enumeration

  1[metadata]
  2creation_date = "2026/07/30"
  3integration = ["network_traffic"]
  4maturity = "production"
  5min_stack_comments = "Requires ES|QL JSON_EXTRACT on _source to read SIP fields across current and legacy schemas."
  6min_stack_version = "9.4.0"
  7updated_date = "2026/07/31"
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12Identifies SIP OPTIONS requests targeting many distinct extension values from a single client within two minutes.
 13Attackers and VoIP scanners use OPTIONS sweeps to discover valid users before REGISTER brute force, toll fraud, or
 14registration hijacking attempts.
 15"""
 16false_positives = [
 17    """
 18    Some legitimate provisioning or monitoring tools enumerate extensions during onboarding. Validate the source against
 19    known PBX management systems before closing.
 20    """,
 21]
 22from = "now-9m"
 23language = "esql"
 24license = "Elastic License v2"
 25max_signals = 5
 26name = "Potential SIP Extension Enumeration"
 27note = """## Triage and analysis
 28
 29### Investigating Potential SIP Extension Enumeration
 30
 31SIP OPTIONS is commonly used for capability discovery. Attack tools such as SIPvicious send OPTIONS across sequential or randomized extensions to map valid users. High cardinality of `Esql.to_user` values from one client IP is a strong reconnaissance signal on VoIP segments.
 32
 33### Possible investigation steps
 34
 35- Review `Esql.sample_extensions` for sequential or patterned usernames indicative of scanning.
 36- Inspect `Esql.user_agents` for scanner strings such as `friendly-scanner` or SIPvicious variants.
 37- Check for follow-on REGISTER or INVITE activity from the same source within the next hour.
 38- Confirm whether `Esql.client_ip` is an expected management or monitoring host for the `Esql.server_ip` PBX/SBC.
 39
 40### False positive analysis
 41
 42- PBX auto-provisioning, extension audits, or SBC health checks may generate OPTIONS to many extensions from a fixed management IP. Add exceptions for those sources only after documenting the tool and schedule.
 43
 44### Response and remediation
 45
 46- Block the scanning `Esql.client_ip` at the SBC or perimeter firewall if the activity is unauthorized.
 47- Enforce SIP authentication and rate limits on the targeted PBX/SBC.
 48- Hunt for subsequent credential access or toll-fraud INVITE patterns from the same source.
 49"""
 50references = ["https://attack.mitre.org/techniques/T1595/", "https://attack.mitre.org/techniques/T1046/"]
 51risk_score = 47
 52rule_id = "e7bf9314-f346-45b5-a6ed-044dc3b839c8"
 53setup = """## Setup
 54
 55This rule requires the Elastic **network_traffic** integration with the **SIP** protocol module enabled on a sensor that
 56observes VoIP signaling traffic. SIP monitoring uses UDP port 5060 by default. Enable the integration's **Use TCP**
 57option when the monitored environment carries plaintext SIP over TCP; Packetbeat monitors the selected transport.
 58
 59The rule requires decoded SIP headers. SIP over TLS (commonly TCP 5061) is not visible unless the sensor receives
 60decrypted traffic or observes plaintext SIP after TLS termination. SRTP encryption does not affect this rule when SIP
 61signaling remains visible.
 62"""
 63severity = "medium"
 64tags = [
 65    "Domain: Network",
 66    "Use Case: Threat Detection",
 67    "Use Case: Network Security Monitoring",
 68    "Tactic: Discovery",
 69    "Tactic: Reconnaissance",
 70    "Data Source: Network Packet Capture",
 71    "Resources: Investigation Guide",
 72]
 73timestamp_override = "event.ingested"
 74type = "esql"
 75
 76query = '''
 77from logs-network_traffic.sip-*, packetbeat-* metadata _source
 78| eval
 79    Esql.method = TO_UPPER(COALESCE(
 80        JSON_EXTRACT(_source, "network_traffic.sip.method"),
 81        JSON_EXTRACT(_source, "sip.method")
 82    )),
 83    Esql.to_user = COALESCE(
 84        JSON_EXTRACT(_source, "network_traffic.sip.to.uri.username"),
 85        JSON_EXTRACT(_source, "sip.to.uri.username")
 86    ),
 87    Esql.user_agent = COALESCE(
 88        JSON_EXTRACT(_source, "network_traffic.sip.user_agent.original"),
 89        JSON_EXTRACT(_source, "sip.user_agent.original")
 90    ),
 91    Esql.client_ip = COALESCE(client.ip, source.ip),
 92    Esql.server_ip = COALESCE(server.ip, destination.ip)
 93| where
 94    Esql.method == "OPTIONS" and
 95    Esql.to_user is not null and
 96    Esql.client_ip is not null and
 97    Esql.server_ip is not null
 98| eval Esql.time_window = DATE_TRUNC(2 minutes, @timestamp)
 99| stats
100    Esql.distinct_extensions = COUNT_DISTINCT(Esql.to_user),
101    Esql.request_count = COUNT(*),
102    Esql.sample_extensions = MV_SLICE(VALUES(Esql.to_user), 0, 20),
103    Esql.user_agents = MV_SLICE(VALUES(Esql.user_agent), 0, 10)
104  by Esql.time_window, Esql.client_ip, Esql.server_ip
105| where Esql.distinct_extensions >= 20
106| keep Esql.*
107'''
108
109
110[[rule.threat]]
111framework = "MITRE ATT&CK"
112[[rule.threat.technique]]
113id = "T1046"
114name = "Network Service Discovery"
115reference = "https://attack.mitre.org/techniques/T1046/"
116
117
118[rule.threat.tactic]
119id = "TA0007"
120name = "Discovery"
121reference = "https://attack.mitre.org/tactics/TA0007/"
122[[rule.threat]]
123framework = "MITRE ATT&CK"
124[[rule.threat.technique]]
125id = "T1595"
126name = "Active Scanning"
127reference = "https://attack.mitre.org/techniques/T1595/"
128
129
130[rule.threat.tactic]
131id = "TA0043"
132name = "Reconnaissance"
133reference = "https://attack.mitre.org/tactics/TA0043/"
134
135[rule.alert_suppression]
136group_by = ["Esql.client_ip", "Esql.server_ip"]
137missing_fields_strategy = "suppress"
138
139[rule.alert_suppression.duration]
140unit = "h"
141value = 1