Loading

Potential SIP Extension Enumeration

Identifies SIP OPTIONS requests targeting many distinct extension values from a single client within two minutes. Attackers and VoIP scanners use OPTIONS sweeps to discover valid users before REGISTER brute force, toll fraud, or registration hijacking attempts.

Rule type: esql
Rule indices:

Rule Severity: medium
Risk Score: 47
Runs every:
Searches indices from: now-9m
Maximum alerts per execution: 5
References:

Tags:

  • Domain: Network
  • Use Case: Threat Detection
  • Use Case: Network Security Monitoring
  • Tactic: Discovery
  • Tactic: Reconnaissance
  • Data Source: Network Packet Capture
  • Resources: Investigation Guide

Version: 1
Rule authors:

  • Elastic

Rule license: Elastic License v2

This rule requires the Elastic network_traffic integration with the SIP protocol module enabled on a sensor that observes VoIP signaling traffic. SIP monitoring uses UDP port 5060 by default. Enable the integration's Use TCP option when the monitored environment carries plaintext SIP over TCP; Packetbeat monitors the selected transport.

The rule requires decoded SIP headers. SIP over TLS (commonly TCP 5061) is not visible unless the sensor receives decrypted traffic or observes plaintext SIP after TLS termination. SRTP encryption does not affect this rule when SIP signaling remains visible.

SIP OPTIONS is commonly used for capability discovery. Attack tools such as SIPvicious send OPTIONS across sequential or randomized extensions to map valid users. High cardinality of Esql.to_user values from one client IP is a strong reconnaissance signal on VoIP segments.

  • Review Esql.sample_extensions for sequential or patterned usernames indicative of scanning.
  • Inspect Esql.user_agents for scanner strings such as friendly-scanner or SIPvicious variants.
  • Check for follow-on REGISTER or INVITE activity from the same source within the next hour.
  • Confirm whether Esql.client_ip is an expected management or monitoring host for the Esql.server_ip PBX/SBC.
  • PBX auto-provisioning, extension audits, or SBC health checks may generate OPTIONS to many extensions from a fixed management IP. Add exceptions for those sources only after documenting the tool and schedule.
  • Block the scanning Esql.client_ip at the SBC or perimeter firewall if the activity is unauthorized.
  • Enforce SIP authentication and rate limits on the targeted PBX/SBC.
  • Hunt for subsequent credential access or toll-fraud INVITE patterns from the same source.
from logs-network_traffic.sip-*, packetbeat-* metadata _source
| eval
    Esql.method = TO_UPPER(COALESCE(
        JSON_EXTRACT(_source, "network_traffic.sip.method"),
        JSON_EXTRACT(_source, "sip.method")
    )),
    Esql.to_user = COALESCE(
        JSON_EXTRACT(_source, "network_traffic.sip.to.uri.username"),
        JSON_EXTRACT(_source, "sip.to.uri.username")
    ),
    Esql.user_agent = COALESCE(
        JSON_EXTRACT(_source, "network_traffic.sip.user_agent.original"),
        JSON_EXTRACT(_source, "sip.user_agent.original")
    ),
    Esql.client_ip = COALESCE(client.ip, source.ip),
    Esql.server_ip = COALESCE(server.ip, destination.ip)
| where
    Esql.method == "OPTIONS" and
    Esql.to_user is not null and
    Esql.client_ip is not null and
    Esql.server_ip is not null
| eval Esql.time_window = DATE_TRUNC(2 minutes, @timestamp)
| stats
    Esql.distinct_extensions = COUNT_DISTINCT(Esql.to_user),
    Esql.request_count = COUNT(*),
    Esql.sample_extensions = MV_SLICE(VALUES(Esql.to_user), 0, 20),
    Esql.user_agents = MV_SLICE(VALUES(Esql.user_agent), 0, 10)
  by Esql.time_window, Esql.client_ip, Esql.server_ip
| where Esql.distinct_extensions >= 20
| keep Esql.*

Framework: MITRE ATT&CK

Framework: MITRE ATT&CK