2.2.1. Network-Based Indicators
💡 First Principle: Malicious network activity differs from normal traffic not in what protocols it uses, but in the patterns — regularity, direction, volume, and destination all reveal intent that individual packets don't.
Network indicators are often the first visible evidence of an intrusion, because most attack activities (C2 communication, lateral movement, exfiltration) require network connectivity. Knowing what each indicator signals helps analysts prioritize investigation paths.
Beaconing — Regular, periodic outbound connections to an external host. Malware "phones home" to its C2 server on a schedule (every 5 minutes, every hour) to receive instructions. The tell: consistent interval, consistent destination, consistent payload size, even when no user is interacting with the machine. Tools: SIEM correlation rules on outbound connection frequency; UEBA anomaly detection.
Bandwidth consumption spikes — Sudden, unexpected increases in outbound bandwidth may indicate data exfiltration. Context matters: a scheduled backup looks like exfiltration in the data; a patch deployment looks like a download spike. Analysts must baseline normal bandwidth patterns before spikes become meaningful.
Irregular peer-to-peer communication — Workstations communicating directly with each other (east-west traffic) rather than through designated servers often indicates lateral movement. In most corporate environments, workstations don't need to communicate directly with each other — this pattern is architecturally unexpected.
Rogue devices on the network — Devices present on the network that aren't in the asset inventory. Could be unauthorized personal devices, attacker-planted hardware (rogue AP, USB drop), or unmanaged IoT devices. Detection: network discovery scans, DHCP log analysis, 802.1X port authentication alerts.
Scans/sweeps — Sequential connection attempts across IP ranges or port ranges. Reconnaissance activity that precedes exploitation. Internal port scans are particularly suspicious — legitimate admin tools don't typically scan the whole subnet.
Activity on unexpected ports — Services listening or communicating on non-standard ports. Legitimate: some organizations run services on non-default ports for obscurity or conflict avoidance. Suspicious: a workstation that normally only makes HTTP/HTTPS connections suddenly communicating on port 4444 (Metasploit default listener).
DNS-based indicators. Two patterns look alike in logs but differ. A domain generation algorithm (DGA) makes malware try many algorithmically generated, random-looking domains to find its live C2 server; the attacker registers only a few of them, recently, so the log shows hundreds of queries per minute to many different domains, mostly NXDOMAIN (does not exist). DNS tunneling or exfiltration encodes data in long, high-entropy subdomain labels under one attacker-controlled domain (a1b2c3d4.secret.attacker.com), producing hundreds to thousands of unique queries to that parent domain, answered only by the attacker's name server. Many different domains plus NXDOMAIN means DGA; one parent domain plus unique labels means tunneling.
Ports and protocols. C2 and exfiltration favor TCP 443 (also 80, and DNS on port 53) because outbound web traffic is almost always allowed and HTTPS blends in. Regular small connections plus a recently registered destination domain (WHOIS) strengthen the case for C2, but a port or payload size alone never proves it.
Network traffic analysis (NTA/NDR) tools such as Zeek and Darktrace passively watch copies of traffic (TAP or SPAN), learn behavioral baselines, and flag anomalies in patterns and protocols. They detect rather than block inline, cannot read encrypted payloads without decryption, and complement rather than replace EDR.
| Indicator | Most Likely Explanation | Investigation Step |
|---|---|---|
| Beaconing (regular outbound every 5 min) | C2 malware | Sandbox the host; block destination IP; analyze process making connection |
| 50GB outbound spike at 3am | Data exfiltration | Identify destination; review what data was accessed prior; check for large file staging |
| Workstation-to-workstation SMB | Lateral movement | Check source for malware; review authentication logs for pass-the-hash |
| New device on network | Rogue device / unauthorized access | Check MAC OUI; review DHCP logs; physically locate if internal |
| Port scan from internal host | Compromised host doing recon | Isolate host; check for RAT/C2 malware |
⚠️ Exam Trap: "Unusual traffic spikes" and "bandwidth consumption" are different indicators. Bandwidth consumption is about volume. Unusual traffic spikes can also refer to sudden bursts of connection attempts or requests that indicate scanning or brute force — not necessarily large data transfers.
Reflection Question: Your SIEM alerts on an internal workstation making outbound HTTPS connections to the same IP address every 8 minutes, 24 hours a day, including overnight when no user is logged in. What does this pattern suggest, and what two investigation steps would you take first?
