Attack techniques explained
69 questions on Attack techniques explained, in plain language: what to check, what NetSenX shows and what a sensor cannot see.
Lateral movement is how an attacker spreads from the first compromised machine to others, typically with stolen credentials over remote services such as SMB, RDP, SSH or WinRM. MITRE ATT&CK lists it as tactic TA0008; Remote Services is technique T1021.
Look for one host connecting to the same external destination at near-regular intervals, around the clock, with small messages of similar size. The pattern shows in flow data and firewall logs, and in encrypted traffic too, because timing, volume and destination are not encrypted.
Largely, yes: who connects to whom, on which port, when and how much data moves are all visible without decryption. What stays hidden is the content of the session, such as the commands sent over an encrypted remote session.
The ones that create traffic between machines, for example Network Service Discovery (T1046), Remote Services (T1021), Application Layer Protocol (T1071), Encrypted Channel (T1573) and Exfiltration Over C2 Channel (T1041). Techniques that stay inside one host are for endpoint tools to see.
Command-and-control (C2) beaconing is malware checking in with the attacker's server at regular intervals to ask for instructions. On the network it looks like small connections to the same destination every few minutes, day and night, often with a little random jitter added so that it looks less regular. Because it is a pattern in time, it stays visible when the traffic is encrypted. Legitimate software beacons too, such as update agents, monitoring tools and chat applications, so what matters is a new destination, a device that has no reason to need it, or a rhythm that never stops, even at night. NetSenX flags beaconing on every plan, Free included, and explains on the alert which features of the timing and destination drove it.
Exfiltration is the theft of data by copying it out of your network, often to cloud storage or to a server the attacker controls, and usually before ransomware encrypts anything. Attackers spread it over nights and weekends or keep each transfer small to avoid simple volume alarms. It is detected by comparing each host's outbound traffic with its own normal: destination, volume and time of day. Watch especially for uploads to cloud storage services or to addresses no other host uses, which public advisories on ransomware groups describe again and again. Encryption hides the content of a transfer, not its volume, destination or timing. NetSenX flags unusual outbound data volume per host, on every plan, Free included.
Living off the land means attackers use the tools already on your systems, such as PowerShell, remote desktop or administration utilities, instead of their own malware. Antivirus often lets them through because the tools are legitimate. What gives them away is unusual use, such as an account signing in where it never has or a workstation opening sessions to many servers. Keeping baselines of normal activity helps, and so does limiting who may use administration tools at all. NetSenX flags new host-to-host sessions, scanning and lateral movement from the network, on every plan. What happens entirely inside one host, such as a script reading files, never crosses the network and needs endpoint detection.
Often, if it talks. A small computer or Wi-Fi bridge hidden under a desk has to reach the attacker, so it shows up as a host making outside connections, often at regular intervals. Check your switches for unknown MAC addresses and use port security or 802.1X where you can. NetSenX sees the traffic of hosts on monitored segments and flags beaconing and unusual connections; a device that stays silent, or sits on a segment you do not monitor, stays out of view.
MITRE ATT&CK is a free, public knowledge base of the tactics and techniques attackers use, built by the non-profit organisation MITRE from real incidents and updated twice a year. Tactics are the attacker's goals, such as initial access, discovery or exfiltration; techniques are the ways of reaching them, each with an identifier such as T1021 for remote services. Defenders use it as a common language: to describe an alert, to compare tools, and to see which techniques their controls cover and which they do not. It is not a checklist to complete, and no product covers every technique. NetSenX names the ATT&CK technique on an alert where a detection corresponds to one, and shows in a coverage view which techniques your enabled detections address.
They describe an attack at three levels of detail. A tactic is the attacker's goal at a given moment, the why: lateral movement, for example, means getting from one machine to others. A technique is how they achieve it, such as using remote services, and a sub-technique narrows it down further, such as remote desktop or SMB administrative shares. A procedure is the specific way a particular group does it: which tool, which command, in which order. Together they are called TTPs. The distinction matters for defence: blocking a procedure, such as one tool's file hash, is easily evaded, while detecting a technique, such as a workstation suddenly opening administrative sessions to many servers, works whatever tool is used. Network detection works mostly at the technique level, which is why NetSenX alerts name techniques rather than tools.
Reconnaissance is the attacker gathering information before acting. In MITRE ATT&CK it is the first tactic and covers what happens outside your network: scanning your public IP addresses for open services, collecting employee names and e-mail formats from your website and social networks, looking up your suppliers, and searching for leaked passwords. Much of it is invisible to you, because it uses public sources. What you can do is reduce what it finds: close unused internet-facing services, keep public detail about your IT setup to a minimum, and check whether company addresses appear in known breaches. Scans of your public addresses show up in firewall logs, although they are constant background noise on the internet. Once inside, attackers do a second round of discovery, which is a separate tactic and much easier to see from the network.
Resource development is the attacker preparing tools and infrastructure for an attack: renting servers, registering look-alike domains, buying or stealing accounts, obtaining malware or code-signing certificates, or buying access to a victim from an initial access broker. It happens on the attacker's side before anything reaches you, so there is little to detect directly. Its traces appear later, which is useful: a domain registered last week that resembles your supplier's, a destination on freshly rented cloud servers, a certificate issued days before the connection. Threat intelligence feeds and advisories publish such infrastructure. Register common misspellings of your own domain and set up DMARC, so that your name is harder to abuse. NetSenX does not watch attackers build their infrastructure; it sees your hosts connecting to it, such as beaconing to a new outside server.
Initial access is the tactic of getting a first foothold in your network. The common ways in are phishing that makes someone run a file or enter a password, exploiting a vulnerability in an internet-facing system such as a VPN gateway or firewall, logging in to remote services with stolen or guessed passwords, abusing a supplier's access, and drive-by downloads from compromised websites. CISA's ransomware advisories list these routes again and again. Most defences sit outside a network sensor: patching internet-facing devices first, multi-factor authentication (MFA) on every remote login, e-mail filtering and closing services you do not need. Initial access itself is often only partly visible on the network, but what follows usually is: the compromised machine contacting the attacker's server. NetSenX flags that beaconing on every plan, Free included.
Execution is the tactic of running the attacker's code on a system: a macro in a document, a script started by a user who was tricked, a command sent through a remote-administration tool, or a scheduled task. It happens inside the host, so the primary defence is there too: endpoint detection and response (EDR), application allow-listing, blocking macros in files from the internet, and limiting scripting tools for ordinary users. A network sensor does not see a process start. It sees the consequences that cross the network, which is often enough to raise the alarm: the new program downloading its next stage, then calling a server at regular intervals, or the machine beginning to scan its neighbours. NetSenX flags those on every plan; it cannot tell you which program on the host did it, which is a question for endpoint tools.
Persistence is how attackers keep their access across reboots, password changes and clean-ups: new accounts, scheduled tasks and services, remote-access tools installed as if they were legitimate, web shells on internet-facing servers, changed VPN or firewall settings, and stolen session tokens for cloud services. Most persistence lives on hosts and in identity systems, so it is found with endpoint tools, directory reviews and configuration comparisons. Check regularly for administrator accounts nobody can explain, remote-access software nobody approved and forwarding rules in mailboxes. What persistence usually needs is a connection back to the attacker, and that is visible on the network: a host that keeps calling the same outside server, even weeks after an incident was closed. NetSenX flags this beaconing on every plan.
Privilege escalation is the attacker turning limited access into more power: from an ordinary user to local administrator, and from there to domain or cloud administrator. They exploit unpatched vulnerabilities, misconfigured services, passwords stored in scripts or browsers, and accounts that have more rights than their job needs. It happens mostly inside hosts and the directory, so prevention is patching, removing local administrator rights from everyday accounts, separate administrator accounts used only for administration, and regular reviews of who belongs to privileged groups. A network sensor sees little of the escalation itself. It sees what the attacker does with the new rights, which typically involves the network: sessions to the domain controller, administrative connections to many servers, access to backups. NetSenX flags that lateral movement on every plan, Free included.
Stealth is the tactic of hiding malicious activity or making it look normal. Since version 19 of MITRE ATT&CK, released in April 2026, it takes over much of the former Defense Evasion tactic, which was split into Stealth and Defense Impairment. Stealth covers techniques such as masquerading as legitimate files or services, hiding artefacts and obfuscating files so that tools and people overlook them. Signature-based tools struggle here, because each piece looks ordinary on its own. What still shows is behaviour that does not fit a host's history: a regular rhythm to a new destination, or a workstation that suddenly talks to many servers. If you map detections to ATT&CK, update references to Defense Evasion. NetSenX looks for such behaviour from the network on every plan; it never decrypts traffic, so it judges patterns, not content.
Defense Impairment is the tactic of disabling, degrading or interfering with security controls. MITRE ATT&CK introduced it in version 19, in April 2026, when it split the former Defense Evasion tactic into Stealth and Defense Impairment. Typical examples are switching off antivirus or endpoint agents, stopping or clearing logs, and changing firewall rules so that the attacker's traffic passes. On the host, the defence is tamper protection on security tools, an alert when an agent stops reporting, and administrator rights limited to few people. The network adds an independent view: a server whose endpoint agent went silent still has to use the network, and NetSenX keeps watching its behaviour, such as beaconing, scanning and uploads, on every plan. It does not see the agent's state itself; the endpoint console shows that, and it is worth checking daily.
Credential access is the tactic of stealing passwords, hashes, tickets and tokens so that the attacker can log in as someone legitimate. Common techniques are dumping credentials from a computer's memory, reading passwords saved in browsers or scripts, guessing or spraying passwords against login services, capturing them on the network with adversary-in-the-middle tricks, and requesting service tickets to crack offline. Defences are multi-factor authentication (MFA), long unique passwords for service accounts, fewer administrator logins on ordinary workstations, and endpoint protection against memory dumping. Part of it is visible on the network, such as many failed connections from one host to login services, or ARP tricks on a segment; most happens on hosts and in the directory. NetSenX sees the network side and, above all, what stolen credentials are used for next: new sessions between hosts.
Discovery is the attacker, now inside, finding out what your network contains: which hosts exist, which services they offer, which shares hold files, who the administrators are and where the backups are. Typical techniques are scanning internal address ranges, listing network shares, querying the directory and reading the configuration of the machine they are on. Unlike reconnaissance from outside, internal discovery crosses your network, which makes it one of the most visible stages: one host suddenly connecting to many internal addresses on SMB, RDP or database ports. Directory queries show up in identity logs rather than to a flow sensor. Segmentation limits what discovery can reach. NetSenX flags internal scanning on every plan, Free included, and from the Pro plan links it to the sessions that follow.
Collection is the attacker gathering the data they want before taking it out: copying files from shares into one place, compressing them into archives, reading mailboxes, exporting a database, taking screenshots. It often shows up as one host suddenly reading far more from file servers or databases than it ever has, sometimes at night, followed by a pause while the archives are built. File and database audit logs show what was read, and endpoint tools see archives being created. On the network, the gathering looks like new sessions from that host to many file servers, and the next step, exfiltration, like unusual outbound volume from it. Limit who can read what, especially service accounts with broad file access. NetSenX flags new host-to-host sessions and unusual outbound data volume per host on every plan; it does not see which files were read inside encrypted sessions.
Command and control is the tactic attackers use to talk to the systems they have compromised: to send commands, receive results and deliver more tools. Techniques include regular check-ins over web protocols, encrypted channels, legitimate cloud services or messaging platforms used as relays, tunnelling through DNS or other protocols, non-standard ports, and proxies that hide the real server. Because the channel has to exist for the attacker to act, it is one of the most reliable things to detect, even when the content is encrypted: timing, destination and rhythm give it away. Blocking known bad destinations helps but does not catch new ones. NetSenX flags beaconing on every plan and DNS tunnelling, and from the Starter plan compares TLS handshakes with fingerprints of known malware where the agent captures packets, on Linux or as a SPAN/TAP sensor.
Impact is the attacker's end goal made visible: encrypting data for ransom, wiping systems, stopping services, corrupting backups, defacing websites, or manipulating data and industrial processes. In ATT&CK it also includes inhibiting recovery, such as deleting shadow copies and backup catalogues. By this stage containment is urgent and evidence is under pressure. Prevention lies earlier: offline backups the attacker cannot reach, separation between IT and production, and alerts on the steps that come before. Encryption itself happens on hosts; where it hits network shares, one client reads and rewrites large amounts of data in a short time. NetSenX has no dedicated detection for the encryption step and does not stop it; it watches the stages before, such as beaconing, scanning, lateral movement and unusual outbound volume, on every plan.
The cyber kill chain is a model published by Lockheed Martin in 2011 that describes an intrusion in seven stages: reconnaissance, weaponisation, delivery, exploitation, installation, command and control, and actions on objectives. Its message is that an attacker must succeed at every stage, while a defender only needs to break one. MITRE ATT&CK is more detailed and better suited to what happens after the first foothold, with many tactics and hundreds of techniques, so most teams use the kill chain to explain an attack to management and ATT&CK to plan detection. Both make the same practical point: attacks take steps, and each step is a chance to notice. For a small company, the later stages, command and control, movement inside the network and data leaving, are where network detection such as NetSenX adds the most.
Start from the attacks you are most likely to face, not from the whole matrix. Take two or three recent public advisories that fit your sector, for example a CISA advisory on a ransomware group, list the techniques they name, and for each ask: would we prevent it, would we see it, and where would we see it? Mark the answer per technique: endpoint, identity, e-mail, network or nothing. The gaps that matter are steps where every answer is nothing. Then test one or two with a simple exercise rather than trusting the table. Do not aim for full coverage; aim for at least one reliable signal in each stage of a typical attack. NetSenX names the ATT&CK technique on its alerts where one applies and shows in a coverage view which techniques your enabled detections address, which fills in the network column of this exercise.
Usually the same sequence. The attacker secures the foothold so that it survives a reboot, contacts their own server for instructions, looks around to learn what the network contains, steals or escalates credentials, moves to more valuable systems such as file servers, the domain controller and the backup server, gathers data, sends it out, and only then, in a ransomware case, encrypts. Some steps take minutes, others weeks. Most of them cross the network: a regular check-in with a new outside server, one host scanning internal ranges, new administrator sessions between machines, unusual uploads. That is why network detection is valuable after the first foothold even when the way in was invisible. NetSenX flags beaconing, scanning, lateral movement and unusual outbound data volume on every plan, Free included, on the segments it monitors.
Partly. Endpoint detection and response (EDR) sees what happens on each machine where it runs, such as a remote-administration tool starting or credentials being dumped, and good EDR catches a lot of lateral movement that way. What it misses are the hosts without an agent, such as printers, cameras, appliances and unmanaged servers, agents that attackers have switched off, and movement that uses legitimate tools with valid passwords, which looks normal on each single machine. The network sees the relationship between hosts: a workstation suddenly opening administrative sessions to servers it never used. That is why the two work best together. NetSenX flags lateral movement and scanning on every plan, Free included, and from the Pro plan correlates hosts into one story; it does not see what runs inside a host, which remains the EDR's job.
Because nothing stops an attacker who gets in from reaching everything. In a flat network every computer, printer and server sits in the same segment and can connect to every other, so one infected laptop can reach the file server, the backup server, the accounting system and the production machines directly. Segmentation splits the network into zones, such as workstations, servers, backups, guests, printers and cameras, and production, with firewall rules that allow only the connections each zone needs. It does not have to be perfect to help: separating backups and the most important servers from ordinary workstations already blocks the most damaging paths. Flat networks also make detection harder, because everything talks to everything. The NetSenX network map, on every plan, shows who actually talks to whom, which is a good starting point for drawing your zones.
Because they behave the same way: they contact a server at regular intervals, day and night, to check for updates, report their status or fetch configuration. Backup agents, antivirus, remote-management tools, time synchronisation and many business applications do it. That is why simple rules based on regular timing alone produce a lot of noise. What separates malware is context: a destination nobody else in the company uses, a recently registered domain or rented server, a device with no reason to run such software, a rhythm that started on a particular day, or traffic that does not fit the program the host is supposed to run. NetSenX judges beaconing against each host's own history and its destination, explains each alert, and lets you mark known software as a false positive, with the decision kept in the audit log.
DNS tunnelling is hiding data or commands inside DNS lookups, the queries every device makes to turn names into addresses. Because almost every network lets DNS through, attackers use it as a channel: data is encoded into long, random-looking subdomains of a domain they control, and their name server answers with instructions. It is slow, but it gets through firewalls that block everything else, and it is used both for command and control and for stealing data in small pieces. Signs are many unique, long subdomains under one domain, unusual record types such as TXT, and a host making far more DNS queries than normal. Forcing all devices to use your own resolvers and logging their queries makes it visible. NetSenX detects DNS tunnelling; it does not see lookups that devices send encrypted to resolvers outside your network.
Yes, if nobody looks at DNS. Data leaving through DNS lookups does not show up as a large upload, because each query carries only a few dozen bytes, and many firewalls allow DNS without inspection. It shows up in the pattern: one host sending thousands of queries to subdomains of the same unfamiliar domain, with long, random-looking names that are never repeated, often at a steady rate. To make it visible, let devices use only your own DNS resolvers, block direct DNS to the internet at the firewall, keep resolver logs, and review domains with unusually many unique subdomains. DNS filtering services add blocklists of known tunnelling domains. NetSenX detects DNS tunnelling on monitored segments; other DNS-based techniques, such as algorithmically generated domains, are not part of what it alerts on today.
It can, and visibility drops. DNS over HTTPS (DoH) sends name lookups inside ordinary encrypted web traffic to a resolver, often a public one, so your own DNS server and its logs never see them. Browsers and some operating systems can switch it on by themselves, and malware can use it to hide both its lookups and tunnelled data. What you can still do: configure browsers and devices by policy to use your own resolver, block known public DoH resolvers at the firewall where that suits your environment, and look into any device that sends steady encrypted traffic to a DoH resolver while ignoring your DNS server. A network sensor sees the connection to the resolver, its timing and volume, but not the names inside. NetSenX never decrypts traffic, so it cannot read DoH lookups; it can still flag the beaconing pattern.
Low-and-slow exfiltration is stealing data in small amounts over a long time, so that no single transfer looks unusual: a few hundred megabytes every lunchtime for a month, or a steady trickle at night, often to a cloud storage service that many people use legitimately. Simple bandwidth alarms miss it because they look for spikes. It is caught by comparing each host with its own history over days and weeks: a server that never uploaded at lunchtime now does so every day, or a workstation sends a little to the same new destination at the same hour. Cloud storage and proxy logs can show it per user. Watch the total sent per host and destination over a week, not only per hour. NetSenX judges outbound volume against each host's normal destinations, volumes and times of day, on every plan.
Because they ask the wrong question. A bandwidth alarm asks whether a link is busier than a fixed limit; data theft is usually designed to stay under it. Attackers send in chunks, at night or during busy hours when a few hundred megabytes vanish among backups and video calls, and to cloud storage services your staff also use, so destination lists do not flag them either. A fixed limit also fires on every large legitimate transfer, so people stop reading the alarms. The useful question is per host: is this machine sending more, to a different destination, or at a different time than it normally does? That needs a baseline per host rather than per link. NetSenX keeps such a baseline and flags unusual outbound data volume per host on every plan, Free included.
Cobalt Strike is a commercial tool for authorised red-team exercises that criminals widely misuse, often in cracked versions, to control compromised machines. On the network its implant, called a beacon, checks in with a team server at a configured interval, usually over HTTPS, sometimes over DNS, or between internal hosts through SMB. Signs include regular connections with jitter to a destination nobody else uses, default or barely changed settings in web requests and certificates, TLS client fingerprints that match published ones for known configurations, and SMB connections between workstations that do not normally talk. Many operators change their configuration to avoid exactly these signs, so behaviour matters more than indicators. NetSenX flags beaconing and lateral movement on every plan, and from the Starter plan compares TLS handshakes with fingerprints of known malware where the agent captures packets, on Linux or as a SPAN/TAP sensor.
Often, unless you know who is doing it. Inside a company network there are a few legitimate scanners, such as a vulnerability scanner, an inventory tool, a network management system or a printer driver looking for devices, and they should be known, scheduled and documented. An ordinary workstation, a printer or a camera suddenly connecting to many internal addresses or many ports in a short time is a different matter: it is one of the clearest signs that someone is mapping the network after getting in, and it usually comes early, before the real damage. Keep a list of approved scanners and their addresses, so that an alert can be checked in seconds, and investigate everything else the same day. NetSenX flags scanning on every plan, Free included, including from devices that run no agent, when watched from a SPAN or TAP port.
Look in two places: the logs of the target and the pattern on the network. The target's logs, on a file server, a remote desktop host, an SSH server or the domain controller, show the failed logins themselves and the account names tried; many failures across many accounts from one source is password spraying, many for one account is brute force. The network shows the source: one host making repeated short connections to a login service, often on several servers. Remote desktop or SSH brute force inside the LAN is not normal; it means a compromised machine or an unauthorised test. Lock out or slow down repeated failures, require multi-factor authentication (MFA) where you can, and investigate the source host. NetSenX sees the repeated connections between hosts on monitored segments and flags the scanning and lateral movement that typically go with them; the count of failed logins lives in the server's log.
Compare each server's outbound traffic with its own normal, and look closely at cloud storage destinations. Many servers never need to send much to the internet, so a database or file server uploading gigabytes to a file-sharing or cloud storage service is unusual in itself; ransomware advisories describe tools such as Rclone being used in exactly this way before encryption. Practical steps: restrict which servers may reach the internet at all, log outbound connections at the firewall or proxy, and review per-server volumes to cloud storage every week. Where you use a cloud service officially, separate its legitimate destinations from consumer accounts at the proxy if you can. NetSenX flags unusual outbound data volume per host, with destination and time, on every plan; it does not see the content of encrypted uploads or which account they went to.
Yes, and it is common. With valid credentials an attacker can log in to remote desktop, VPN, SSH, file shares and cloud services like any employee, and use the administration tools already installed. Antivirus has nothing to detect, because there is no malicious file, and every single login may look normal on its own. What gives them away is the pattern: an account logging in from a computer it never used, at an unusual hour, to many systems in a short time; a workstation that suddenly talks to servers; a service account used interactively. Multi-factor authentication (MFA), separate administrator accounts and limits on which machines may connect to which are the main defences. NetSenX sees the network side of this, new host-to-host sessions and scanning, on every plan; it does not see the login events in your directory, which identity logs show.
Both, because each sees what the other misses. Authentication logs from the directory, servers and VPN show which account logged in where, with what method and whether it failed; they are the best source for stolen credentials, but only for systems that log, keep the logs and send them somewhere you read. Network flows show which host connected to which, on which port, how often and how much, for every device on a monitored segment, including those that keep no logs: printers, appliances, unmanaged servers. They do not show account names. In practice, a new session between two hosts that never talked is a network signal, and the account behind it is an identity question. NetSenX covers the network side on every plan; pair it with your directory's sign-in logs or a SIEM, to which NetSenX can export from the Business plan.
Graph-based detection treats your network as a map of who talks to whom: each host is a point, each connection a line, and the map is compared with its usual shape over time. Lateral movement shows up as new lines that do not fit, such as a workstation suddenly connected to several servers, a chain of hops from one machine to the next, or a group of hosts all reaching the same new outside address. The advantage is context: a single new connection may be harmless, while a new path from a user's laptop through a file server to the backup server is not. The approach has been studied in academic research for years. From the Pro plan, NetSenX correlates hosts into such a graph, so that a scan followed by new remote sessions, or several hosts beaconing to one destination, appears as one story instead of scattered alerts.
Often, by design. A rule describes something already known: a file hash, a domain, a sequence of events someone has seen before. It is precise and cheap, and it works well against commodity malware. It fails when attackers change a detail, use legitimate tools, or take a path through your network that nobody wrote a rule for, such as a new server, a forgotten supplier account or an unusual chain of hops. Behaviour-based detection asks a different question: is this host doing something it has not done before, compared with its own history and its peers? It catches new paths but needs time to learn what is normal, and its alerts need judgement. Most mature setups combine both. NetSenX detects behaviour on the network, such as beaconing, scanning, lateral movement and unusual outbound volume, and explains each alert, so that you can tell a new attack path from a new business process.
A printer that suddenly connects to hundreds of internal addresses within a few minutes is either badly configured or compromised. Some printers and their drivers legitimately look for devices or scan-to-folder targets, but that pattern is regular and limited; mapping whole address ranges is not. Printers run full operating systems, often with old firmware, default passwords, web interfaces and stored address books, so attackers can take one over and use it as a quiet base from which to scan, relay connections or store tools, knowing nobody looks at its logs. Update the firmware, change the default password, disable the services you do not need, and put printers in their own segment that can reach the print server but not every computer. NetSenX flags scanning on every plan, from a SPAN or TAP port, without any software on the printer.
By containing first and then removing, in one coordinated move. Find out as much as you can quietly: which hosts and accounts are involved, how the attacker gets in and out, and where their tools are. Then act together: isolate the affected hosts at the switch or firewall, block their outside destinations, disable or reset the compromised accounts from a clean device, and close the way in, such as a VPN account or an exposed service. Acting piecemeal warns the attacker, who may switch hosts or start damaging systems. Bring in an incident-response firm if you have not already, and keep a log. After containment, rebuild affected machines and watch closely for weeks. NetSenX does not remove attackers; it shows from the network which hosts are involved and where they connect, which is what a containment plan needs, and it flags renewed activity afterwards.
Sometimes within an hour, sometimes over weeks. Groups that use automated tools and stolen administrator passwords can reach servers very quickly after the first foothold, while others wait, explore and copy data before acting. Security vendors publish breakout time measurements, but those describe their own customers and methods, so treat any single figure with caution. The practical conclusion is the same in every case: assume you may have little time after the first sign. Decide in advance who can isolate a host at night, make sure alerts reach a person who reads them, and keep segmentation between workstations and servers so that the attacker's path is longer. NetSenX flags the steps that usually follow the foothold, beaconing, scanning and lateral movement, on every plan, and that is where the time to react comes from.
Look for signs on the computer and on the network, and reduce the risk either way. On the computer: unexpected remote-access tools, pop-ups asking you to re-enter banking details, browser extensions you did not install, security software that was switched off. On the network: the PC contacting an unfamiliar outside server at regular intervals, day and night, which is how banking malware and remote-access trojans stay in touch with their operators. Your bank's own alerts about new devices or changed payees matter too. The safest setup is a dedicated computer, or a separate user account used only for banking, with no e-mail on it, current updates and two-person approval for payments above a limit. NetSenX flags beaconing from that PC on every plan; it does not see what happens in the browser and does not replace the bank's own security checks.
By looking at what the database server sent out, not at the database itself. An ERP export of customers, prices or payroll is large, and the server it lives on normally talks to the ERP application, the backup system and a few users, not to the internet. Signs are a large outbound transfer from that server, or from a workstation that has just pulled a big export, especially at night or to cloud storage; a database dump file appearing on a file share; or a new remote session to the server shortly before. Restrict internet access from database servers and log exports in the ERP itself. NetSenX flags unusual outbound data volume per host, with destination and time, on every plan; it does not see which tables were inside an encrypted transfer.
Usually, once it knows the backup. A legitimate backup or cloud sync runs from known hosts to known destinations at regular times, with similar volumes night after night, and it starts on the day the job was set up. Theft usually differs in at least one way: a host that never uploads, a new destination, an unusual hour, or volume far above that host's normal. When theft uses the same cloud provider as your backups, the account and the exact destination differ, which a proxy or the provider's own logs show better than flow data. NetSenX compares each host's uploads with its own history and explains the alert, so the nightly backup job stays recognisable; if it does fire, mark it as a false positive once, and the decision is kept in the audit log.
Most workstation traffic to a domain controller is harmless: logins, group policy, time synchronisation and name resolution happen around the clock, at night too. What is not normal is a workstation opening an interactive remote session to the domain controller, such as remote desktop or remote management, or using administrative shares on it, especially from a computer that belongs to someone outside IT and at an hour when nobody works. That is a typical step before an attacker takes over the directory, creates accounts or pushes ransomware everywhere. Restrict administrative access to domain controllers to a few dedicated administration machines. NetSenX flags such new host-to-host administrative sessions as lateral movement on every plan, and from the Pro plan links them with the scanning that often comes first.
ARP spoofing is a device on your local network falsely announcing that it is the router or another host, so that traffic meant for them flows through it. It lets an attacker read unencrypted traffic, capture credentials or tamper with connections, and it only works from inside the same segment, for example from a compromised PC or a device plugged into a free socket. On managed switches, dynamic ARP inspection together with DHCP snooping blocks it; port security and 802.1X limit who can plug in; encrypting internal services limits the damage. Without managed switches, look for one MAC address claiming several IP addresses, especially the gateway's. A sensor on the segment sees such conflicting announcements, and the NetSenX network map shows the devices on monitored segments, so a newcomer stands out.
It depends on the Wi-Fi security and on what is encrypted above it. On an open network, or one where everyone shares the same password, a person on the network can, with some effort, see or redirect other users' traffic; WPA3 makes passive reading much harder, and WPA2 or WPA3 Enterprise with individual logins separates users better. Client isolation on guest networks stops devices from talking to each other at all. In practice most traffic today is protected by HTTPS, so the bigger risks are redirection to fake login pages and attacks on devices that still use unencrypted protocols, such as old printers or cameras. Keep guests on an isolated network and staff on individual logins. NetSenX does not manage Wi-Fi; on monitored segments it shows which devices talk to which and flags scanning from a newcomer.
Not from the network alone. A network sensor sees which host sent how much, to where and when, and sometimes the protocol and server name; the program that opened the connection is known only on the host itself. To get it, use endpoint detection and response (EDR) or the operating system's own connection logging on important servers, and record process and network events together so that a transfer can be matched to its process afterwards. Firewalls and proxies that authenticate users can add the account. In practice the network alert tells you which server and which minute to look at, which makes finding the process quick. NetSenX flags unusual outbound data volume per host, with time and destination, on every plan; it does not name the process or the user behind it.
A supply chain attack reaches you through someone you trust: a software vendor whose update is tampered with, an IT service provider whose remote-management tool is abused, a supplier with VPN access to your network, or a hacked partner whose e-mail is used to send you malicious invoices. It works because the access or the software is legitimate, so it passes the checks you apply to strangers. Defences are knowing which suppliers have access to what, giving each the least access it needs and its own accounts with multi-factor authentication (MFA), disabling access when it is not in use, and asking about their security in contracts. NIS2 lists supply chain security among the cybersecurity risk-management measures in Article 21. NetSenX cannot see a tampered update being built; it sees what the supplier's access or software then does on your network, such as beaconing or new sessions.
A zero-day is a vulnerability that attackers exploit before the vendor has released a fix, so patching cannot help yet and no signatures exist. Zero-days are expensive and often used against internet-facing systems such as VPN gateways, firewalls and file-transfer servers. Detection therefore relies on what happens after the exploit: an appliance that suddenly talks to new outside servers, a web server that starts scanning the internal network, new administrator sessions, data leaving. Reduce exposure by keeping as few services as possible reachable from the internet, putting management interfaces behind a VPN, and following vendor advisories and CISA's Known Exploited Vulnerabilities catalogue, so that you patch the moment a fix appears. NetSenX does not detect the exploit itself; it flags the behaviour that follows, such as beaconing, scanning and unusual outbound volume, on every plan.
Both guess passwords, in opposite directions. Brute force tries many passwords against one account, which usually triggers an account lockout and shows up clearly in the target's logs. Password spraying tries one or two common passwords, such as a season and a year, against many accounts, staying under lockout limits, and often spreads the attempts over hours or across several services. Spraying is more common against VPNs, webmail and cloud logins, where account names are easy to guess. The defences are the same for both: multi-factor authentication (MFA), banning common passwords, and alerts on failed logins across many accounts from one source. Inside the company, either one appears on the network as one host making repeated short connections to login services. NetSenX shows those connections between hosts; the failure counts and accounts tried are in the server's or identity provider's logs.
Credential stuffing is attackers taking e-mail and password pairs leaked from other websites and trying them automatically on your logins, betting that people reuse passwords. It targets internet-facing services, such as webmail, VPN, customer portals and cloud applications, and comes from many addresses at once, so it often looks like a normal mix of logins with a slightly higher failure rate. The defences are multi-factor authentication (MFA), a policy against password reuse, checking company addresses against known breach collections, and rate limits on login pages. For your customers' accounts, offer MFA and watch for many failed logins across accounts. A network sensor inside your company sees little of this, because it happens at your public services or at a cloud provider. NetSenX sees what a successful login is used for afterwards, if it leads to activity on your internal network.
Kerberoasting is an attack on Active Directory in which any logged-in user requests service tickets for accounts that run services, then takes the tickets away and cracks them offline to recover those accounts' passwords. It needs no special rights, makes little noise and works best against service accounts with weak, old passwords, which often have broad privileges. Defences are long random passwords for service accounts, preferably managed service accounts that rotate automatically, strong encryption types for Kerberos, and alerts in the directory's logs when one host requests many service tickets in a short time. The ticket requests are directory events, visible to identity monitoring rather than to a flow sensor. NetSenX does not alert on Kerberos activity; it sees what the cracked accounts are then used for, such as new administrative sessions to servers.
Pass-the-hash is an attacker using the stored hash of a password, taken from a compromised computer's memory or disk, to authenticate as that user without ever knowing the password itself. It works with the older NTLM authentication still common in many networks and lets an attacker move from machine to machine with an administrator's identity. Defences include not logging in with domain administrator accounts on ordinary workstations, a unique local administrator password on each machine, protections that stop credentials being read from memory, restricting or disabling NTLM where possible, and endpoint protection. The hash theft happens on a host; the reuse appears on the network as administrative connections between machines that do not normally talk. NetSenX flags that lateral movement on every plan; it does not inspect the authentication protocol itself.
A drive-by download infects a computer when someone simply visits a web page: a compromised legitimate website, a malicious advertisement, or a page that pretends to be a browser update or a CAPTCHA and tricks the user into running something. CISA's advisory on the Interlock ransomware group, AA25-203A of 22 July 2025, describes drive-by downloads from compromised legitimate websites and the ClickFix technique, in which a fake prompt persuades the user to paste and run a command. Defences are current browsers and operating systems, DNS and web filtering, stopping users from running scripts they paste, and teaching people that a website never needs them to run a command. Once something runs, it usually calls home: NetSenX flags the resulting beaconing to a new outside server on every plan.
A botnet is a network of infected computers, routers, cameras and other devices that a criminal controls remotely and rents out for spam, credential stuffing, denial-of-service attacks or as a relay for other crimes. Owners rarely notice, because the device keeps working; the cost is your bandwidth, your public address ending up on blocklists, and an attacker with a foothold in your network. Signs are a device contacting a command server at regular intervals, sudden bursts of outbound connections to many addresses, mail sent from a device that should not send mail, or a report from your provider or national CERT. Update internet-connected devices, change their default passwords and block outbound mail except from your mail server. NetSenX flags beaconing and unusual outbound volume per host on every plan, including for devices that cannot run an agent.
A remote-access trojan is malware that gives an attacker full control of a computer: they can see the screen, log keystrokes, open files, switch on the camera, run commands and use the machine as a stepping stone into the network. It usually arrives through phishing attachments, fake software downloads or cracked programs, and it keeps a connection to its operator, either open all the time or by checking in at intervals. On the computer, endpoint protection and application control are the main defences. On the network, the connection to the operator is the most reliable sign: small, regular traffic to an unfamiliar destination, often over HTTPS or an unusual port, sometimes relayed through a legitimate cloud service. NetSenX flags this beaconing on every plan, and from the Starter plan compares TLS handshakes with fingerprints of known malware where the agent captures packets, on Linux or as a SPAN/TAP sensor.
An initial access broker is a criminal who breaks into companies and sells that access to others instead of using it: VPN logins, remote desktop credentials, a web shell on a server or control of an infected laptop. Ransomware groups and other criminals buy such access on criminal markets and start their attack from there, sometimes weeks later. For a victim this has two consequences. The first intrusion may be quiet and look unrelated to the later damage, and the attacker who encrypts may not be the one who got in. And the time between access and attack is an opportunity: accounts used from unusual places, a new remote-access tool or a server calling an outside address can be found before the buyer arrives. NetSenX flags the beaconing and new sessions that such access tends to produce, on every plan; identity logs show the logins.
A web shell is a small malicious script placed on a web server, usually through a vulnerability in an internet-facing application, that lets an attacker run commands on the server through ordinary web requests. It is a common way to keep access to exploited systems such as file-transfer servers, mail servers or content management systems, and it blends into normal web traffic. Signs are new or changed script files in web directories, web server processes starting command shells, and the server itself suddenly connecting out to the internet or to internal machines it never talked to before. Patch internet-facing applications quickly, monitor web directories for changes and limit what the web server can reach. The file is visible on the host; NetSenX sees the network behaviour that follows, such as a public-facing server scanning the internal network or sending unusual volumes out, on every plan.
Protocol tunnelling is hiding one kind of traffic inside another so that it passes firewalls and looks harmless: commands or stolen data wrapped in DNS lookups, in ordinary web requests, in ICMP pings or inside an SSH connection. Attackers use it to keep a command channel open when direct connections are blocked, or to reach internal systems through a single compromised host. It shows up as protocols behaving oddly: DNS queries with long random names, pings carrying far more data than usual, an SSH session that lasts for days and moves a lot of data, or a host forwarding connections for others. Limit which protocols may leave the network and from which hosts, and force DNS through your own resolvers. NetSenX detects DNS tunnelling and flags beaconing and unusual outbound volume on every plan; it never decrypts traffic, so an encrypted tunnel is judged by its pattern.
Because they are trusted. Remote-support and remote-management tools are signed, commonly installed and allowed through firewalls, so antivirus rarely flags them, and their traffic goes to the vendor's cloud like every legitimate session. Attackers install them after getting in, or abuse ones already present, to keep access that survives a password change. CISA's advisories on groups such as Akira and Medusa describe exactly this use of remote-access software. Keep a list of the tools your company actually uses, block the installation of others, require multi-factor authentication (MFA) on the ones you allow, and remove those nobody needs. On the network, an unexpected tool shows up as a host connecting regularly to a remote-access vendor it never used before. NetSenX flags such new regular check-ins as beaconing on every plan; deciding whether a tool is approved is up to you.
Wiper malware destroys data instead of holding it for ransom: it overwrites files, disk structures or firmware so that systems cannot start or data cannot be recovered. It is used for sabotage, sometimes disguised as ransomware with a ransom note that leads nowhere, and companies can be hit as collateral damage when it spreads through shared suppliers or networks. Because there is nothing to negotiate, offline backups and a tested recovery plan are the only real answer. The steps before wiping are similar to other intrusions: access, command and control, movement to many machines, sometimes through central management tools that push the wiper everywhere at once. NetSenX does not detect the wiping itself, which happens on hosts; it watches the earlier steps, such as beaconing, scanning and lateral movement, on every plan.
Cryptojacking is criminals using your computers, servers or cloud accounts to mine cryptocurrency for themselves. It rarely steals data, but it costs electricity and cloud spend, slows systems, wears out hardware, and shows that someone has a way in, often through an unpatched internet-facing server or stolen cloud keys. On the host it shows as sustained high processor load from an unknown process. On the network, miners keep a long-lived connection to a mining pool, often on unusual ports, with small regular messages in both directions around the clock. Block known mining-pool destinations at the firewall where you can, watch cloud bills for unexplained compute, and patch internet-facing servers. NetSenX flags regular, persistent connections to a new outside destination as beaconing on every plan; the processor load is a matter for endpoint or cloud monitoring.