---
title: Potential SIP Extension Enumeration
description: Identifies SIP OPTIONS requests targeting many distinct extension values from a single client within two minutes. Attackers and VoIP scanners use OPTIONS...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/network/discovery_potential_sip_extension_enumeration
products:
  - Elastic Security
---

# Potential SIP Extension Enumeration
Identifies SIP OPTIONS requests targeting many distinct extension values from a single client within two minutes.
Attackers and VoIP scanners use OPTIONS sweeps to discover valid users before REGISTER brute force, toll fraud, or
registration hijacking attempts.
**Rule type**: esql
**Rule indices**:
**Rule Severity**: medium
**Risk Score**: 47
**Runs every**: 
**Searches indices from**: `now-9m`
**Maximum alerts per execution**: 5
**References**:
- [[https://attack.mitre.org/techniques/T1595/](https://attack.mitre.org/techniques/T1595/)](https://attack.mitre.org/techniques/T1595/)
- [[https://attack.mitre.org/techniques/T1046/](https://attack.mitre.org/techniques/T1046/)](https://attack.mitre.org/techniques/T1046/)

**Tags**:
- Domain: Network
- Use Case: Threat Detection
- Use Case: Network Security Monitoring
- Tactic: Discovery
- Tactic: Reconnaissance
- Data Source: Network Packet Capture
- Resources: Investigation Guide
- Noise: Unknown
- Performance: Normal
- Rule Type: ES|QL

**Version**: 2
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

## Setup

This rule requires the Elastic **network_traffic** integration with the **SIP** protocol module enabled on a sensor that
observes VoIP signaling traffic. SIP monitoring uses UDP port 5060 by default. Enable the integration's **Use TCP**
option when the monitored environment carries plaintext SIP over TCP; Packetbeat monitors the selected transport.
The rule requires decoded SIP headers. SIP over TLS (commonly TCP 5061) is not visible unless the sensor receives
decrypted traffic or observes plaintext SIP after TLS termination. SRTP encryption does not affect this rule when SIP
signaling remains visible.

## Investigation guide


## Triage and analysis


### Investigating Potential SIP Extension Enumeration

SIP OPTIONS is commonly used for capability discovery. Attack tools such as SIPvicious send OPTIONS across sequential or randomized extensions to map valid users. High cardinality of `Esql.to_user` values from one client IP is a strong reconnaissance signal on VoIP segments.

### Possible investigation steps

- Review `Esql.sample_extensions` for sequential or patterned usernames indicative of scanning.
- Inspect `Esql.user_agents` for scanner strings such as `friendly-scanner` or SIPvicious variants.
- Check for follow-on REGISTER or INVITE activity from the same source within the next hour.
- Confirm whether `Esql.client_ip` is an expected management or monitoring host for the `Esql.server_ip` PBX/SBC.


### False positive analysis

- PBX auto-provisioning, extension audits, or SBC health checks may generate OPTIONS to many extensions from a fixed management IP. Add exceptions for those sources only after documenting the tool and schedule.


### Response and remediation

- Block the scanning `Esql.client_ip` at the SBC or perimeter firewall if the activity is unauthorized.
- Enforce SIP authentication and rate limits on the targeted PBX/SBC.
- Hunt for subsequent credential access or toll-fraud INVITE patterns from the same source.


## Rule Query

```esql
from logs-network_traffic.sip-*, packetbeat-* metadata _source
| eval
    Esql.method = TO_UPPER(COALESCE(
        JSON_EXTRACT(_source, "network_traffic.sip.method"),
        JSON_EXTRACT(_source, "sip.method")
    )),
    Esql.to_user = COALESCE(
        JSON_EXTRACT(_source, "network_traffic.sip.to.uri.username"),
        JSON_EXTRACT(_source, "sip.to.uri.username")
    ),
    Esql.user_agent = COALESCE(
        JSON_EXTRACT(_source, "network_traffic.sip.user_agent.original"),
        JSON_EXTRACT(_source, "sip.user_agent.original")
    ),
    Esql.client_ip = COALESCE(client.ip, source.ip),
    Esql.server_ip = COALESCE(server.ip, destination.ip)
| where
    Esql.method == "OPTIONS" and
    Esql.to_user is not null and
    Esql.client_ip is not null and
    Esql.server_ip is not null
| eval Esql.time_window = DATE_TRUNC(2 minutes, @timestamp)
| stats
    Esql.distinct_extensions = COUNT_DISTINCT(Esql.to_user),
    Esql.request_count = COUNT(*),
    Esql.sample_extensions = MV_SLICE(VALUES(Esql.to_user), 0, 20),
    Esql.user_agents = MV_SLICE(VALUES(Esql.user_agent), 0, 10)
  by Esql.time_window, Esql.client_ip, Esql.server_ip
| where Esql.distinct_extensions >= 20
| keep Esql.*
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Discovery
  - Id: TA0007
  - Reference URL: [[https://attack.mitre.org/tactics/TA0007/](https://attack.mitre.org/tactics/TA0007/)](https://attack.mitre.org/tactics/TA0007/)
- Technique:
  - Name: Network Service Discovery
  - Id: T1046
  - Reference URL: [[https://attack.mitre.org/techniques/T1046/](https://attack.mitre.org/techniques/T1046/)](https://attack.mitre.org/techniques/T1046/)

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Reconnaissance
  - Id: TA0043
  - Reference URL: [[https://attack.mitre.org/tactics/TA0043/](https://attack.mitre.org/tactics/TA0043/)](https://attack.mitre.org/tactics/TA0043/)
- Technique:
  - Name: Active Scanning
  - Id: T1595
  - Reference URL: [[https://attack.mitre.org/techniques/T1595/](https://attack.mitre.org/techniques/T1595/)](https://attack.mitre.org/techniques/T1595/)