Traffic Duplication

Subtechnique · ATTACK:enterprise:T1020.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1020.001",
  "title": "Traffic Duplication",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1020/001",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--7c46b364-8496-4234-8a56-f7e6727e21e1",
  "external_id": "T1020.001",
  "domain": "enterprise",
  "created": "2020-10-19T13:40:11.118Z",
  "modified": "2025-10-24T17:49:00.388Z",
  "version": "1.4",
  "aliases": [

  ],
  "tactics": [
    "exfiltration"
  ],
  "source_references": [
    {
      "source_name": "AWS Traffic Mirroring",
      "url": "https://docs.aws.amazon.com/vpc/latest/mirroring/traffic-mirroring-how-it-works.html"
    },
    {
      "source_name": "Cisco Traffic Mirroring",
      "url": "https://www.cisco.com/c/en/us/td/docs/routers/crs/software/crs_r5-1/interfaces/configuration/guide/hc51xcrsbook/hc51span.html"
    },
    {
      "source_name": "GCP Packet Mirroring",
      "url": "https://cloud.google.com/vpc/docs/packet-mirroring"
    },
    {
      "source_name": "Juniper Traffic Mirroring",
      "url": "https://www.juniper.net/documentation/en_US/junos/topics/concept/port-mirroring-ex-series.html"
    },
    {
      "source_name": "Azure Virtual Network TAP",
      "url": "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-tap-overview"
    },
    {
      "source_name": "Cisco Blog Legacy Device Attacks",
      "url": "https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954"
    },
    {
      "source_name": "US-CERT-TA18-106A",
      "url": "https://www.us-cert.gov/ncas/alerts/TA18-106A"
    }
  ]
}

Explicit source assertions (5)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.