2.2.1. Network-Based Indicators
💡 First Principle: Malicious network activity differs from normal traffic not in what protocols it uses, but in the patterns — regularity, direction, volume, and destination all reveal intent that individual packets don't.
Network indicators are often the first visible evidence of an intrusion, because most attack activities (C2 communication, lateral movement, exfiltration) require network connectivity. Knowing what each indicator signals helps analysts prioritize investigation paths.
Beaconing — Regular, periodic outbound connections to an external host. Malware "phones home" to its C2 server on a schedule (every 5 minutes, every hour) to receive instructions. The tell: consistent interval, consistent destination, consistent payload size, even when no user is interacting with the machine. Tools: SIEM correlation rules on outbound connection frequency; UEBA anomaly detection.
Bandwidth consumption spikes — Sudden, unexpected increases in outbound bandwidth may indicate data exfiltration. Context matters: a scheduled backup looks like exfiltration in the data; a patch deployment looks like a download spike. Analysts must baseline normal bandwidth patterns before spikes become meaningful.
Irregular peer-to-peer communication — Workstations communicating directly with each other (east-west traffic) rather than through designated servers often indicates lateral movement. In most corporate environments, workstations don't need to communicate directly with each other — this pattern is architecturally unexpected.
Rogue devices on the network — Devices present on the network that aren't in the asset inventory. Could be unauthorized personal devices, attacker-planted hardware (rogue AP, USB drop), or unmanaged IoT devices. Detection: network discovery scans, DHCP log analysis, 802.1X port authentication alerts.
Scans/sweeps — Sequential connection attempts across IP ranges or port ranges. Reconnaissance activity that precedes exploitation. Internal port scans are particularly suspicious — legitimate admin tools don't typically scan the whole subnet.
Activity on unexpected ports — Services listening or communicating on non-standard ports. Legitimate: some organizations run services on non-default ports for obscurity or conflict avoidance. Suspicious: a workstation that normally only makes HTTP/HTTPS connections suddenly communicating on port 4444 (Metasploit default listener).
| Indicator | Most Likely Explanation | Investigation Step |
|---|---|---|
| Beaconing (regular outbound every 5 min) | C2 malware | Sandbox the host; block destination IP; analyze process making connection |
| 50GB outbound spike at 3am | Data exfiltration | Identify destination; review what data was accessed prior; check for large file staging |
| Workstation-to-workstation SMB | Lateral movement | Check source for malware; review authentication logs for pass-the-hash |
| New device on network | Rogue device / unauthorized access | Check MAC OUI; review DHCP logs; physically locate if internal |
| Port scan from internal host | Compromised host doing recon | Isolate host; check for RAT/C2 malware |
⚠️ Exam Trap: "Unusual traffic spikes" and "bandwidth consumption" are different indicators. Bandwidth consumption is about volume. Unusual traffic spikes can also refer to sudden bursts of connection attempts or requests that indicate scanning or brute force — not necessarily large data transfers.
Reflection Question: Your SIEM alerts on an internal workstation making outbound HTTPS connections to the same IP address every 8 minutes, 24 hours a day, including overnight when no user is logged in. What does this pattern suggest, and what two investigation steps would you take first?
