Attackers hide in the gaps between SOC alerts using valid accounts and admin protocols; Corelight promotes NDR telemetry
This sponsored Corelight article argues that SOC alerts rarely show how an intrusion began or progressed, because adversaries spend days or weeks inside environments and blend into normal business traffic. It describes a generic low-and-slow tradecraft chain: paced LDAP reconnaissance from a compromised account, Kerberos service ticket requests for offline cracking, lateral movement over SMB and RDP with valid credentials, staging and compression of files, and periodic exfiltration over HTTPS or DNS with timing jitter. The article does not describe a specific incident, actor, malware or vulnerability. It recommends retaining protocol-aware network telemetry from NDR platforms so analysts and AI-assisted SOC workflows can correlate events across hosts, users, protocols and time. It is vendor marketing for Corelight's NDR product.
Detalhes técnicos
- Reconnaissance: a compromised account queries a domain controller over LDAP at a modest pace to map users, groups and systems.
- Credential access: a handful of Kerberos service ticket requests yield material to crack offline.
- Lateral movement: valid credentials are used over SMB or RDP, the same services administrators use daily.
- Collection and exfiltration: files are gathered and compressed on one internal host, which later contacts an external destination over HTTPS or DNS at regular intervals with slight timing variation.
- Detection angle: significance emerges from sequences, e.g. a host that queries several internal services, authenticates to a peer, opens an SMB session and then connects externally.
Remediação
- Retain protocol-aware network telemetry so analysts can look back when an alert fires.
- Correlate endpoint alerts with network evidence: earlier unusual domain queries, authentication to other systems, SMB sessions to peers and later encrypted external sessions.
- Build automated, AI-assisted investigation workflows over NDR data to surface related activity, leaving final judgement to analysts.
Linha do tempo
-
Attackers hide in the gaps between SOC alerts using valid accounts and admin protocols; Corelight promotes NDR telemetry
ler a análise desta fonte ocultar
This sponsored Corelight article argues that SOC alerts rarely show how an intrusion began or progressed, because adversaries spend days or weeks inside environments and blend into normal business traffic. It describes a generic low-and-slow tradecraft chain: paced LDAP reconnaissance from a compromised account, Kerberos service ticket requests for offline cracking, lateral movement over SMB and RDP with valid credentials, staging and compression of files, and periodic exfiltration over HTTPS or DNS with timing jitter. The article does not describe a specific incident, actor, malware or vulnerability. It recommends retaining protocol-aware network telemetry from NDR platforms so analysts and AI-assisted SOC workflows can correlate events across hosts, users, protocols and time. It is vendor marketing for Corelight's NDR product.
Technical Details
- Reconnaissance: a compromised account queries a domain controller over LDAP at a modest pace to map users, groups and systems.
- Credential access: a handful of Kerberos service ticket requests yield material to crack offline.
- Lateral movement: valid credentials are used over SMB or RDP, the same services administrators use daily.
- Collection and exfiltration: files are gathered and compressed on one internal host, which later contacts an external destination over HTTPS or DNS at regular intervals with slight timing variation.
- Detection angle: significance emerges from sequences, e.g. a host that queries several internal services, authenticates to a peer, opens an SMB session and then connects externally.
Remediation
- Retain protocol-aware network telemetry so analysts can look back when an alert fires.
- Correlate endpoint alerts with network evidence: earlier unusual domain queries, authentication to other systems, SMB sessions to peers and later encrypted external sessions.
- Build automated, AI-assisted investigation workflows over NDR data to surface related activity, leaving final judgement to analysts.