Do rule-based security tools miss new attack paths?

Often, by design. A rule describes something already known: a file hash, a domain, a sequence of events someone has seen before. It is precise and cheap, and it works well against commodity malware. It fails when attackers change a detail, use legitimate tools, or take a path through your network that nobody wrote a rule for, such as a new server, a forgotten supplier account or an unusual chain of hops. Behaviour-based detection asks a different question: is this host doing something it has not done before, compared with its own history and its peers? It catches new paths but needs time to learn what is normal, and its alerts need judgement. Most mature setups combine both. NetSenX detects behaviour on the network, such as beaconing, scanning, lateral movement and unusual outbound volume, and explains each alert, so that you can tell a new attack path from a new business process.

← All 69 questions on Attack techniques explainedAll topics