Command and Control
Techniques that cybercriminals use to communicate with compromised devices within a target company’s network.
Techniques that cybercriminals use to communicate with compromised devices within a target company’s network.
Unauthorized transfer of sensitive and/or private data from a device in your network to an outside destination.
A variety of methods to examine and probe a target infrastructure in search of live hosts, services and weaknesses.
Techniques attackers use to advance from initial entry points, moving deeper into critical network assets and systems.
Infected hosts trying to signal and communicate back with command and control servers, asking for instructions.
Hacking methods that use trial and error to crack passwords, login credentials and encryption keys.
Techniques where a malicious actor poses as a trusted service or resource to steal sensitive data and bypass security.
We gather data on potential and active threats to identify malicious network addresses, hostnames, and more.
Usage of vulnerable protocols and applications, cleartext communications, insecure authentication methods, etc.
Investigating cyber incidents is challenging. The complexity is so high that even with high-quality evidence, security analysts can struggle to determine if an event was a natural failure or a result of malicious intent. Security software alerts and logs don’t always clarify this; for instance, your enterprise EDR might flag an "attempt to kill agent process" but can’t reveal who attempted it or why.
While hackers continuously develop new methods to evade detection, forensic analysts are often overwhelmed, sifting through logs to piece together the puzzle of an attack. However, one unavoidable truth stands in every successful cyber breach: hackers must traverse the network at each major stage of an attack. From initial reconnaissance and internal discovery, to command and control (C2) connections, victim beacons, lateral movement, and ultimately data collection and exfiltration—each phase leaves traces on the network.
If you suspect a breach on an endpoint or server, don’t waste time chasing ambiguous evidence—gather network data from the machine, run it through the Network Data Analyzer, and quickly confirm or dismiss your suspicion with clear indicators of an attack.