LoFP LoFP / some legitimate provisioning or monitoring tools enumerate extensions during onboarding. validate the source against known pbx management systems before closing.

Techniques

Sample rules

Potential SIP Extension Enumeration

Description

Identifies SIP OPTIONS requests targeting many distinct extension values from a single client within two minutes. Attackers and VoIP scanners use OPTIONS sweeps to discover valid users before REGISTER brute force, toll fraud, or registration hijacking attempts.

Detection logic

from logs-network_traffic.sip-*, packetbeat-* metadata _source
| eval
    Esql.method = TO_UPPER(COALESCE(
        JSON_EXTRACT(_source, "network_traffic.sip.method"),
        JSON_EXTRACT(_source, "sip.method")
    )),
    Esql.to_user = COALESCE(
        JSON_EXTRACT(_source, "network_traffic.sip.to.uri.username"),
        JSON_EXTRACT(_source, "sip.to.uri.username")
    ),
    Esql.user_agent = COALESCE(
        JSON_EXTRACT(_source, "network_traffic.sip.user_agent.original"),
        JSON_EXTRACT(_source, "sip.user_agent.original")
    ),
    Esql.client_ip = COALESCE(client.ip, source.ip),
    Esql.server_ip = COALESCE(server.ip, destination.ip)
| where
    Esql.method == "OPTIONS" and
    Esql.to_user is not null and
    Esql.client_ip is not null and
    Esql.server_ip is not null
| eval Esql.time_window = DATE_TRUNC(2 minutes, @timestamp)
| stats
    Esql.distinct_extensions = COUNT_DISTINCT(Esql.to_user),
    Esql.request_count = COUNT(*),
    Esql.sample_extensions = MV_SLICE(VALUES(Esql.to_user), 0, 20),
    Esql.user_agents = MV_SLICE(VALUES(Esql.user_agent), 0, 10)
  by Esql.time_window, Esql.client_ip, Esql.server_ip
| where Esql.distinct_extensions >= 20
| keep Esql.*