Detecting Compromised Systems: Analysing the top eight indicators of threat traffic

Key indicators of a compromise can be found by analysing the network traffic from outbound connections—specifically, traffic coming from an endpoint on your internal network and connecting through your firewall to something on the internet. Focusing on this threat traffic will give your organisation visibility into early indicators of a potential threat.

The goal is to detect a compromised endpoint. Endpoint security solutions certainly assist with this aim, but whether you have such technology deployed or not, the analysis of anomalous network traffic is critical to detecting ongoing compromised systems. So, what are the best ways to identify a compromise from network traffic alone?

In this paper, we review eight sets of network-related traffic, from the potentially suspicious to the downright malicious and discuss how you can use each to detect a compromised system.