What does NetSenX see after someone clicks a phishing link?

NetSenX sees what the device does on the network afterwards, not the e-mail or the click itself. It does not read mail content and it does not decrypt traffic. What it can show, on every plan: a device that starts regular, timed connections to an outside server it never used before (beaconing); a device that starts scanning other machines; connections between internal hosts that point to lateral movement; and unusual volumes of data leaving the network. Where the agent captures packets, on Linux or through a mirror (SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it.) port, plans from Starter also show TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS. fingerprints, which help pick out tools that do not match the device's usual software. Alerts name the MITRE ATT&CK technique, and from Starter they come with response recommendations. If the phishing only steals a cloud login that is then used from the attacker's own computer, none of that traffic touches your network, and your identity provider's sign-in logs are the place to look.

← All 29 questions on Phishing and e-mail aftermathAll topics