What happens after an attacker gets into the network?
Usually the same sequence. The attacker secures the foothold so that it survives a reboot, contacts their own server for instructions, looks around to learn what the network contains, steals or escalates credentials, moves to more valuable systems such as file servers, the domain controller and the backup server, gathers data, sends it out, and only then, in a ransomware case, encrypts. Some steps take minutes, others weeks. Most of them cross the network: a regular check-in with a new outside server, one host scanning internal ranges, new administrator sessions between machines, unusual uploads. That is why network detection is valuable after the first foothold even when the way in was invisible. NetSenX flags beaconing, scanning, lateral movement and unusual outbound data volume on every plan, Free included, on the segments it monitors.