A server sends data out at night. What should we check?
First, whether it is a job you know. Look at the time, the destination and the volume, and compare them with your backup schedule, software updates and any synchronisation with a cloud service. A known backup goes to a known destination at a fixed time. If the destination is new, the volume unusual or the server normally quiet at that hour, find the responsible process on the server itself, check who logged in shortly before, and use the firewall or proxy log to see how long it has been happening. Cut the server off from the internet if the transfer continues and nobody can explain it. NetSenX flags unusual outbound data volume per host on every plan and keeps the time, destination and volume of each alert for the history your plan includes; it does not see which files were inside an encrypted transfer.
Read next
Related questions
- Our public IP address is on a blocklist. Does that mean we have been hacked?
- A colleague says the mouse moved by itself. Is someone controlling the computer?
- How do we check a suspicious computer without tipping off the attacker?
- How do I know if my business network has been compromised?
- Can an attacker stay inside a network for years without being noticed?