Can attackers move through our network with stolen passwords and no malware?
Yes, and it is common. With valid credentials an attacker can log in to remote desktop, VPN, SSH, file shares and cloud services like any employee, and use the administration tools already installed. Antivirus has nothing to detect, because there is no malicious file, and every single login may look normal on its own. What gives them away is the pattern: an account logging in from a computer it never used, at an unusual hour, to many systems in a short time; a workstation that suddenly talks to servers; a service account used interactively. Multi-factor authentication (MFA), separate administrator accounts and limits on which machines may connect to which are the main defences. NetSenX sees the network side of this, new host-to-host sessions and scanning, on every plan; it does not see the login events in your directory, which identity logs show.
Read next
Related questions
- Should we detect lateral movement from authentication logs or from network flows?
- What is graph-based detection of lateral movement?
- Do rule-based security tools miss new attack paths?
- Why would a printer scan our network, and can printers be used to attack other computers?
- How do we stop an attacker who is already in our network?