MITRE ATT&CK
How to detect lateral movement and C2 beaconing
Lateral movement is an attacker spreading from the first compromised machine to others, usually by signing in with stolen credentials over remote services. Command-and-control (C2) beaconing is compromised software checking in with the attacker's server at regular intervals for instructions. Both have to cross the network, so both can be detected from network traffic even when it is encrypted: lateral movement as unusual host-to-host sessions on administration protocols, beaconing as a steady rhythm of small connections to one destination.
The fact to plan around
In joint guidance published on 7 February 2024, CISA, the NSA, the FBI and partner agencies warned that attackers who "live off the land" use the same legitimate tools as administrators, so their activity blends in with normal operations, and recommended keeping baselines of normal network, user and administrative activity in order to spot what deviates from them.
How to detect them
Four practices that work with any tooling, and that NetSenX automates.
01Keep a baseline of who talks to whom
Lateral movement is only visible against what is normal. Record which hosts usually connect to which servers, and on which ports: a workstation that suddenly opens SMB or RDP sessions to ten servers stands out against that baseline.
02Watch east–west traffic, not only the perimeter
Host-to-host traffic inside the LAN never crosses the internet firewall. Put a SPAN or TAP port, or a sensor, inside each segment you need to see.
03Look for rhythm, not content
Beaconing shows up as connections to one destination at near-constant intervals, often with small, similar-sized messages and a little random jitter. Timing and volume stay visible when the session is encrypted.
04Correlate across hosts
Several hosts beaconing to the same new domain, or one host scanning and then signing in to the machines it scanned, is a stronger signal than any single connection.
Mapped to MITRE ATT&CK
Technique names and IDs are MITRE's. The last column names the NetSenX detection category this traffic falls under; it does not mean every variant of the technique is caught.
| Technique | What it looks like on the network | NetSenX detection |
|---|---|---|
| T1046 Network Service DiscoveryDiscovery | One host connecting to many internal addresses or ports within a short time. | Scanning |
| T1021 Remote ServicesLateral Movement | A workstation opening SMB, RDP, SSH or WinRM sessions to servers or other workstations it has never used before. | Lateral movement |
| T1071 Application Layer ProtocolCommand and Control | Small, regular connections to the same external destination over HTTPS, day and night. | C2 beaconing |
| T1573 Encrypted ChannelCommand and Control | The same rhythm inside TLS: timing, volume, destination and the handshake stay visible without decryption. | C2 beaconing, from metadata |
| T1041 Exfiltration Over C2 ChannelExfiltration | A beaconing host that suddenly sends much more data out over the same channel. | Unusual outbound data volume |
| T1048 Exfiltration Over Alternative ProtocolExfiltration | Large outbound transfers over a protocol the host does not normally use for that. | Unusual outbound data volume |
What NetSenX does today
- Detects scanning, lateral movement, C2 beaconing and unusual outbound data volume from network behaviour, on every plan, Free included.
- From the Pro plan, correlates hosts into a graph of who talks to whom, so a scan followed by new remote sessions, or several hosts beaconing to one destination, appears as one story instead of scattered alerts.
- Names the MITRE ATT&CK technique on the alert where a detection corresponds to one, and shows in a coverage view which techniques your enabled detections address.
- Analyses encrypted traffic from timing, volume and destinations, and from the Starter plan also from the TLS handshake, and never decrypts it. The handshake is visible only where the agent captures packets: on Linux or as a sensor on a SPAN or TAP port, not in the basic mode used on macOS.
What NetSenX does not do
NetSenX sees lateral movement only where it crosses a segment you monitor: a session between two hosts on an unmonitored segment, or activity that stays inside one machine, is out of its view. It does not read the content of encrypted sessions, it does not replace incident response, and it does not claim to catch every variant of every ATT&CK technique listed on this page.
Questions buyers ask
What is lateral movement in cybersecurity?
Lateral movement is how an attacker spreads from the first compromised machine to others, typically with stolen credentials over remote services such as SMB, RDP, SSH or WinRM. MITRE ATT&CK lists it as tactic TA0008; Remote Services is technique T1021.
How do you detect C2 beaconing?
Look for one host connecting to the same external destination at near-regular intervals, around the clock, with small messages of similar size. The pattern shows in flow data and firewall logs, and in encrypted traffic too, because timing, volume and destination are not encrypted.
Can you detect lateral movement in encrypted traffic?
Largely, yes: who connects to whom, on which port, when and how much data moves are all visible without decryption. What stays hidden is the content of the session, such as the commands sent over an encrypted remote session.
Which MITRE ATT&CK techniques can network detection see?
The ones that create traffic between machines, for example Network Service Discovery (T1046), Remote Services (T1021), Application Layer Protocol (T1071), Encrypted Channel (T1573) and Exfiltration Over C2 Channel (T1041). Techniques that stay inside one host are for endpoint tools to see.
Sources
- CISA, NSA, FBI and partner agencies — Joint guidance: Identifying and mitigating living off the land techniques, 7 February 2024 (published by NCSC New Zealand)
- MITRE ATT&CK — Lateral Movement (TA0008)
- MITRE ATT&CK — Command and Control (TA0011)
This page is general information, not legal advice. Check your obligations with your national authority or legal counsel.
Related pages
Try NetSenX on your own network
Start on the Free plan with up to 3 devices, or book a 20-minute demo.