Intrusion signs
How to tell if someone is inside your network
Someone is inside your network when an attacker holds working access to at least one of your machines or accounts and uses it to look around, move to other systems or take data. The signs are rarely an alarm. They are small changes in behaviour: a host contacting a new destination at regular intervals, an account signing in where it never has, a server sending far more data out than usual. Most of them can be checked today, for free, with logs an administrator already has.
The fact to plan around
On 7 February 2024, CISA, the NSA and the FBI, with partner agencies, reported in joint advisory AA24-038A that Volt Typhoon actors had kept access to some victims' IT environments for at least five years, relying mostly on the victims' own administration tools rather than malware.
What leaves your network after 18:00
One illustrative night in a small company's network: six kinds of device, four kinds of destination. Move the clock to see what leaves, how much, and which flows would raise an alert. Size alone is not the signal: the backup's large transfer is normal, a small upload from a PC that is usually off is not.
Illustrative data, not a captured detection
| Device | Destination | Volume | Would this alert? |
|---|---|---|---|
| Accounting PC | Unknown destinations | 180 MB | Yes: unusual outbound data volume |
| ERP server | Known business services | 20 MB | No: usual for this device |
| Meeting-room TV | Known business services | 3 MB | No: usual for this device |
| CCTV recorder | Known business services | 30 MB | No: usual for this device |
| Developer laptop | Unknown destinations | 1 MB | Yes: command-and-control beaconing |
Show each device's usual night as a table
| Device | Its usual night |
|---|---|
| Accounting PC | Busy in office hours with business services and some AI tools; quiet at night. |
| ERP server | A little synchronisation with business services every hour, day and night. |
| Meeting-room TV | Small updates from its vendor. |
| CCTV recorder | A steady stream to its vendor's cloud. |
| Developer laptop | Business services and AI tools in office hours; quiet at night. |
| Backup server | One large copy to its usual backup provider each night. |
What a network sensor cannot see here: the file names and content inside encrypted sessions, and which program on the device sent the data. Endpoint protection (EDR) sees that.
Signs to look for, and free checks you can run today
None of these proves an intrusion on its own. Each is cheap to check, and two or more together deserve an investigation.
01New or rare outbound destinations
A host that starts contacting a domain or IP address nobody else in the company uses, especially a recently registered one. Check: export the top destinations from your firewall or DNS server for the last 30 days and look at those contacted by a single host.
02Connections at regular intervals
Malware checking in with its operator often connects every few minutes, day and night, with small messages of similar size. Check: in firewall or proxy logs, sort one host's connections to a single destination by time and look for a steady rhythm outside working hours.
03Sign-ins at odd times or from odd places
Successful sign-ins at night, from countries where you have no staff, or by accounts that normally never sign in interactively, such as service accounts. Check: review the last 30 days of successful sign-ins in your directory or identity provider, filtered to outside business hours.
04One machine talking to many
A workstation that connects to dozens of internal hosts on administration ports such as SMB (445), RDP (3389), SSH (22) or WinRM (5985 and 5986) is scanning or moving laterally. Check: in firewall or switch flow data, count the distinct internal destinations per source host on those ports.
05Unusual outbound volume
A server that suddenly uploads gigabytes, often at night or to a cloud storage service it does not normally use. Check: compare each host's outbound bytes this week with its own average.
06New admin accounts, tasks and services
Accounts added to administrator groups, new scheduled tasks or services, and remote-access tools nobody approved. Check: list the members of privileged groups and the recently created scheduled tasks and services on your servers, and ask who added each one.
What NetSenX does today
- Watches how every host behaves on the network and flags command-and-control beaconing, scanning, lateral movement and unusual outbound data volume, on every plan, Free included.
- Sees devices that run no agent, such as printers, cameras and controllers, because one agent on a SPAN or TAP port watches the whole segment.
- Explains every alert in plain language, listing the network features that drove its score, so a small team can tell an intrusion from a new backup job.
- Writes alerts, analyst decisions and configuration changes to an audit log, and tracks the NIS2 Article 23 deadlines if an incident turns out to be significant.
What NetSenX does not do
NetSenX does not see what happens inside a host without touching the network, such as a malicious process that never connects anywhere; endpoint protection (EDR) covers that ground. It never decrypts traffic, so it cannot read the content of an encrypted session. It does not replace incident response: containing and rebuilding a host stays with your team or your response provider. An alert is a reason to investigate, not proof of an intrusion.
Questions buyers ask
How do I know if my business network has been compromised?
Look for behaviour that has changed: new outbound destinations, connections at regular intervals, sign-ins at odd hours, one machine connecting to many others, and unusual outbound volume. Each can be checked in firewall, DNS and directory logs. Two or more together are worth an investigation; continuous network monitoring watches for all of them every day, not only on the day you look.
Can an attacker stay inside a network for years without being noticed?
Yes. In joint advisory AA24-038A of 7 February 2024, CISA, the NSA and the FBI reported that Volt Typhoon actors had kept access to some victims' IT environments for at least five years. Attackers who use the same administration tools as your IT team leave few signatures behind, which is why behaviour on the network matters.
What free checks can I run today?
Export the top outbound destinations from your firewall or DNS server and look at the rare ones; review successful sign-ins outside business hours; count how many internal hosts each workstation contacts on SMB, RDP, SSH and WinRM ports; and compare each server's outbound volume with its own average.
Does NetSenX replace antivirus or EDR?
No. NetSenX adds the network view: it sees devices that run no agent and the movement between hosts. Endpoint protection still covers what happens inside each machine. The Free plan has no time limit and needs no credit card, so you can see what it finds on your own network first.
Sources
- CISA, NSA, FBI and partners — Joint advisory AA24-038A (PRC state-sponsored actors, Volt Typhoon), 7 February 2024
- CISA, NSA, FBI and partner agencies — Joint guidance: Identifying and mitigating living off the land techniques, 7 February 2024 (published by NCSC New Zealand)
- MITRE ATT&CK — Lateral Movement (TA0008)
This page is general information, not legal advice. Check your obligations with your national authority or legal counsel.
Related pages
Try NetSenX on your own network
Start on the Free plan with up to 3 devices, or book a 20-minute demo.