Which MITRE ATT&CK techniques can network detection see?
The ones that create traffic between machines, for example Network Service Discovery (T1046), Remote Services (T1021), Application Layer Protocol (T1071), Encrypted Channel (T1573) and Exfiltration Over C2C2: command and control. The channel an attacker's software uses to receive instructions from the attacker's server. Channel (T1041). Techniques that stay inside one host are for endpoint tools to see.
This answer also appears, with more context, here: Lateral movement and C2 beaconing
Read next
Related questions
Terms used here
- C2 (command and control)
- The channel an attacker's software uses to receive instructions from the attacker's server.