1200KM / detection
T1430.002 Impersonate SS7 Nodes — Detection Rules
Detection workspace for T1430.002 Impersonate SS7 Nodes: 0 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
No reviewed association in this snapshot.
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0662 Detection of Impersonate SS7 Nodes
AN1753 Analytic 1753
Defender observes anomalous signaling network queries targeting subscriber information associated with a device, including unexpected routing requests, location information exchanges, or node-origin inconsistencies indicative of SS7 signaling abuse. The CSRIC also suggests threat information sharing between telecommunications industry members.
AN1754 Analytic 1754
Defender observes anomalous signaling interactions involving subscriber identity or location resolution events associated with a device, including abnormal routing requests, unexpected location information exchanges, or signaling node inconsistencies indicative of SS7 abuse. The CSRIC also suggests threat information sharing between telecommunications industry members.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
T1430.002 simulation workspace
No reviewed association in this snapshot.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.