Attackers hide routine activity in the gaps between SOC alerts
Original title: Between alerts: What Attackers Do in the Spaces Ordinary Detection Misses
The explainer says LDAP, Kerberos, SMB, and slow HTTPS or DNS transfer can look like ordinary business traffic.
A Hacker News explainer argues that many SOC alerts do not show how an intrusion began or progressed. It describes adversaries using compromised accounts for paced LDAP discovery, Kerberos service-ticket requests, SMB or RDP movement, and gradual HTTPS or DNS exfiltration. It says protocol-aware network detection and response telemetry can connect those steps, and that AI-assisted investigation still needs that network evidence. No specific incident, victim, or new vulnerability is reported.
- The piece says high-priority alerts may appear days or weeks after initial access.
- Example activity includes modest LDAP queries against a domain controller.
- Kerberos service-ticket requests are described as a source of credentials to crack offline.
- Data may leave over HTTPS or DNS with timing varied to resemble normal traffic.
- The argument is for retaining NDR telemetry rather than lowering every detection threshold.
From the original article
6 min read at thehackernews.com
Every SOC struggles with a pile of alerts. Very few of those alerts explain how an attack started or how it progressed. Network data, like that from a network detection and response (NDR) platform, connects individual alerts into one timeline, and it feeds the defensive systems that can tie all events together into one coordinated view.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.