Practical knowledge for network defenders

Investigations

Investigating ARP Scans

ARP scanning is common during inventory and troubleshooting, but an attacker can also use it to map nearby systems. Treat it as a discovery signal, then check the source and what happened next.

Network discovery · T1018 Remote System Discovery Read investigation guide → Investigations

Investigating Port Sweeps

A port sweep can build a target list for exploitation or lateral movement. It matters most when the source is not approved and later connects to one of the services it found.

Network discovery · T1046 Network Service Discovery Read investigation guide → Investigations

Investigating Port Scans

Security tools perform port scans routinely, but an attacker can use one to profile a chosen target. The ports tested and any successful follow-through matter more than the scan label alone.

Network discovery · T1046 Network Service Discovery Read investigation guide → Investigations

Investigating Control Connections

Control connections are essential for legitimate administration and useful to an attacker operating a compromised system. Confirm who connected, what they used, and whether commands or files followed.

Remote access · T1021 Remote Services / T1219 Remote Access Software Read investigation guide → Investigations

Investigating Service Enumerations

Identity, inventory, backup, and monitoring tools generate plenty of legitimate enumeration. Worry when a user endpoint or unusual process performs it and then uses what it discovered.

Discovery and enumeration · T1046 Network Service Discovery Read investigation guide → Investigations

Investigating Login Brute-Force Attempts

Network traffic can show the pattern, but authentication logs tell you whether these were actually rejected logins. A success after repeated failures is the result to act on.

Credential access · T1110 Brute Force Read investigation guide → Investigations

Investigating Web Scraping Activities

Crawlers and monitoring systems scrape sites legitimately every day. Risk goes up when an unknown source systematically collects sensitive, internal, or authenticated content.

Automated collection · T1594 Search Victim-Owned Websites / T1213 Data from Information Repositories Read investigation guide → Investigations

Investigating HTTPS Beacons

Malware beacons, updates, telemetry, and notifications can all produce the same regular HTTPS pattern. The process, destination, timing, and any follow-on activity tell you which one you have.

Command and control · T1071.001 Application Layer Protocol: Web Protocols Read investigation guide → Investigations

Investigating SYN Floods

A SYN flood may be an attack, heavy legitimate demand, or a broken client. Confirm that the service was actually affected before treating the traffic volume as proof.

Denial of service · T1499.001 OS Exhaustion Flood Read investigation guide → Investigations

Investigating SOCKS Tunnels

Approved proxies and VPNs rely on tunneling, and attackers use the same capability to pivot or hide traffic. Identify the process, the endpoints, and what the tunnel carried.

Tunneling and proxying · T1572 Protocol Tunneling / T1090 Proxy Read investigation guide → Investigations

Investigating Suspicious Endpoints

Reputation is a starting point, not proof. Outbound contact from an internal device, especially through an unknown process or repeated connection, matters far more than an unanswered inbound probe.

Threat intelligence · Context-dependent reputation signal Read investigation guide → Investigations

Investigating Collection Activities

Backups, synchronization, and software delivery move large volumes every day. Escalate when sensitive data is staged by an unusual process or followed by external transfer, deletion, or encryption.

Data movement · T1074 Data Staged Read investigation guide →