Thread by @bettersafetynet

You have network monitoring capabilities. Great! But what are you looking for?

All too often folks start focusing on individual attacks. And yes, it's important that you can catch the latest RAT from Grid Iguana (from Hacksylvania)

Don't lose sight of the big picture.
1

Monitor for DMZ outbound traffic.
Almost all DMZ systems are responding to some request from remote user. Your DMZ systems are the destination, not the source. An early indicator an attack worked is a DMZ system phoning home to the C2 network. Your machine is a source here.
2

Like all things, this isn't 100%. There will be a few DMZ systems that do originate outbound traffic... but it should be rare enough that you can detect on this alone and have a short exception list for known outbound originators.
3

Next, look at top talkers. I like to do this by protocol.
Who spoke the most DNS (besides the DNS Servers)? That might be a misconfiged box, or DNS tunneling.

Who spoke the most HTTPS? Could be you found the marketing person not doing any work all week long.
4

For top talker analysis, consider two forms. Raw packet count and raw byte count. Look for the outliers here.

C2 traffic can have high raw packet count.
Exfil of your data can be high raw bytes.
5

Now start looking for long connections. Most network protocols are short use and short lived. (Think website traffic).

C2 is long lived. Your net mon tools will show it as hours... most other things will be minutes... if that!
6

Next, look for port/protocol mismatch. While you're allowed to send HTTPS to TCP 53, it's strange (so much so it was odd to type that). Likewise, 80 could be telnet. But dang is that odd.

This will be one of your lowest false positive network detects. PLEASE DO THIS
7

At the very best, you've found a misconfigured bit of software, or maybe a NIC flaking out. More evil option is you found some post exploitation tool that doesn't expect you to do this analysis.

Port protocol mismatch is awesome and needs to be done everywhere.
8

If you only did the stuff I've covered so far, and consistently, you'd be ahead of many networks.

The final advice is to start doing this analysis on a per team basis.
9

Do everything I covered at each point in your network. You'll start being able to ask odd questions.

Future you: Why is Bob in accounting talking to other internal servers at 5x the volume of anyone else? The rate is WELL below our alarm trigger, but he's not THAT busy.
10

This is how you WIN in NSM. I love doing the deep catches for APT XYZ, but if you did just these outlined steps, (get ready for this)

You won't need APT group specific detects that much, because you'll already be catching them through these meta indicators.

Happy hunting!
fin.