
Summary
The analytic "Detect Unauthorized Assets by MAC address" serves to identify unauthorized devices attempting to connect to a corporate network through the analysis of DHCP request packets. This detection method works by comparing MAC addresses found in DHCP requests against a predefined list of authorized devices, as referenced in the assets_by_str.csv file. The underlying premise is that unauthorized devices present significant security risks, including but not limited to potential data breaches and network interruptions. If identified as malicious, these unauthorized connections may enable attackers to gain unwarranted access to the network, which could lead to further exploitation or data exfiltration endeavors. Consequently, monitoring for such unauthorized MAC addresses is crucial for maintaining the integrity and security of networked environments.
Categories
- Network
Data Sources
- Network Traffic
Created: 2024-11-15