Network correlation
A single PowerShell A command-line shell and scripting language built on the .NET framework, commonly used for system administration and potentially for malicious purposes. process may look legitimate. A burst of HTTPS Network Traffic The data moving between hosts on a network, observed as connections, flows, and packets. In triage, traffic metadata (who talked to whom, when, how much, and over which port and protocol) is often the fastest way to confirm or rule out command and control, exfiltration, or lateral movement. may look harmless. Together, they show the process making regular, automated connections to a newly registered Domain Either a DNS name like example.com that identifies internet infrastructure, or a Windows Active Directory domain, the identity and authentication boundary attackers aim to own; context makes the sense clear. As an indicator, a DNS domain's age, registrar, and reputation are among the first pivots in triage. — the shape of Beaconing Periodic network communication from an infected host to a C2 server. , and a hypothesis neither event earned alone. The picture changes.
Two perspectives, one picture
Who initiated the connection?
- Which process opened the socket
- Under which user context it executed
- The command-line arguments that produced it
- What the process did locally before and after
Where does the traffic go?
- Destination IP, port, and ASN
- Frequency and cadence of communication
- TLS certificate properties and cipher choice
- How the destination compares to historical traffic
A beacon hiding in HTTPS
A workstation initiates outbound HTTPS connections from PowerShell at 03:15 local time.
Correlation reveals three signals that, in isolation, are not decisive:
- The PowerShell process launched outside the User The identity behind activity on a system: the account that authenticated, launched the process, or received the email. In triage the user field names an account, not necessarily a person; whether the legitimate owner was actually behind the activity is exactly the question stolen credentials raise. ‘s normal working hours.
- Within seconds, the host established encrypted HTTPS sessions to a domain registered 48 hours earlier.
- The destination has low prevalence in historical DNS data, and the TLS client fingerprint ( JA3 A method for fingerprinting TLS client applications by hashing specific fields in the TLS Client Hello packet. Degraded against modern clients: Chrome's extension-order randomization (2023) and GREASE values fragment a single client into many hashes. / JA4 The 2023 successor to JA3 from FoxIO. A modernized TLS-client fingerprint that sorts extensions before hashing (defeating randomization), handles TLS 1.3, and covers QUIC natively via a leading "q" or "t" transport marker. Part of the JA4+ suite, which adds separate fingerprints such as JA4H (HTTP client) and JA4S (TLS server). ) does not match any browser or approved tool in the environment.
Keep the two layers separate. What is observed: off-hours execution, a 48-hour-old domain, low prevalence, an unrecognized client fingerprint. What is inferred: initial compromise and command-and-control. The combination earns that as the working hypothesis — the correlation is the alert — but it is the start of the investigation, not its verdict.
Why no single signal was decisive — and what decides
- PowerShell at 03:00 could be a developer working late.
- HTTPS to a new domain could be a new SaaS tool.
- Low-prevalence destinations exist legitimately.
Each indicator on its own would be tuned out as noise. The combination crosses the alerting threshold — and the whole set still has a benign twin: a contractor’s late-night run of a just-installed vendor CLI against the vendor’s freshly launched endpoint matches all three. The decisive follow-ups separate the twins: what launched the process (parent, user, scheduled task, or interactive session), whether the cadence holds a fixed machine interval over hours, who registered and operates the destination, and whether anything else in the fleet talks to it.
Telemetry to analyze
Four primary surfaces, each with its own signal patterns:
DNS queries
- Algorithmically generated DGA Domain Generation Algorithm. A technique where malware computes domain names at runtime so command-and-control servers can rotate quickly to avoid blocklists. domains detected via entropy scoring
- Randomized subdomains
- Extremely short TTLs or fast-flux patterns
Network connections
- Traffic to recently observed external destinations
- Known malicious ranges from threat intelligence
- Unusual port usage, uncommon protocols
Data transfer patterns
- Automated beaconing (consistent packet sizes at consistent intervals)
- Human-driven traffic is irregular and variable
- Sustained large outbound transfers off-hours
Protocol usage
- Tunneling or obfuscation (DNS over HTTPS bypassing inspection)
- TLS abuse (malformed certificates, unusual ciphers)
- Custom encryption layers
A finance workstation that normally talks only to internal ERP systems and then initiates TLS sessions to a low-reputation cloud storage provider outside business hours is a strong Exfiltration The unauthorized transfer of data from a system or network, often as part of a data breach or espionage operation. hypothesis — and only that until questions the metadata cannot answer get answered: what actually transferred (volume approximates content only where DLP or object-level logs exist), and whether anyone authorized a new destination, because a sanctioned backup migration or vendor onboarding produces this exact trace. The decisive queries: the process that opened the sessions, transfer volume against the host’s own baseline, and whether the destination tenant belongs to the organization or a contracted vendor.
Correlation strategies
Three dimensions to weigh on every connection:
Connection metadata
Timestamps, source and destination IPs, ports, session durations, TLS cipher and handshake behavior.
Payload characteristics
Fixed packet sizes, repetitive transmission intervals, hallmarks of automated beaconing.
Destination reputation
Domain age, prevalence in the environment, threat intelligence overlap, geographic anomalies, TLS client fingerprints (JA3/JA4), certificate provenance.
A PowerShell process repeatedly reaching out via HTTPS to a newly registered domain using a self-signed TLS certificate carrying a generic common name is a classic obfuscated-C2 pattern — and an internal tool polling a just-provisioned dev endpoint can match it field for field, which is why the pattern opens an investigation rather than closing one; the process’s parent and the destination’s owner are the queries that split the two. Do not require the shady certificate, though: modern commodity C2 fronts with valid certificates from free CAs or hides behind CDNs, which is why domain age, prevalence, and TLS client fingerprints (JA3/JA4) carry more weight than certificate hygiene. Without combining process-level context, network Metadata Data about data: file timestamps, owner, size, hash; an email's headers; a process's parent, command line, and signing certificate. In triage, metadata is often more diagnostic than the content itself. , and reputation scoring, the same activity might pass for ordinary HTTPS traffic.
Command-and-control indicators
Adversaries hide C2 inside legitimate protocols (HTTPS, DNS). The automation underneath leaves fingerprints.
⏱️ Timing patterns
Frameworks often default to precise beacon intervals. Legitimate traffic rarely has that cadence.
🔐 TLS certificates
Mismatched, self-signed, or generic-CN certificates still appear on cheap infrastructure, but valid certificates are now the norm for C2. Treat certificate hygiene as weak evidence; client fingerprints (JA3/JA4) identify the connecting software regardless of the certificate.
🔎 DNS patterns
High-volume queries for random-looking domains (DGA). Rapid IP rotation tied to a single domain (fast-flux). Domains registered in the last 30 days.
📤 Exfiltration indicators
Large compressed transfers outside normal hours. Outbound spikes to low-reputation destinations.
An internal database Server A host whose role is to provide services to other systems rather than to a person at a keyboard. The distinction drives triage: web browsing and office documents are routine on a workstation but anomalous on a server, an interactive server login warrants checking who made it since only administrators should have a reason to, and a compromised server typically exposes data or downstream users at scale. that suddenly sends gigabytes of zipped data to a generic cloud storage provider at 02:30 is a strong signal that data is leaving — and a hypothesis of theft, not proof of it. Volume, timing, and destination establish that something large moved somewhere unusual; they cannot establish intent, and a DBA’s ad-hoc backup to a newly provisioned storage tenant leaves the identical trace. What separates the cases: a change record or maintenance window, ownership of the destination, and the process and identity that initiated the transfer. If those come back empty on a database server, escalate on the evidence you have — an unexplained bulk transfer from a high-value asset meets criteria without a motive attached.
Key Takeaway
Network correlation moves you from isolated alerts to unified adversary visibility. State what you observed separately from what you infer, name the benign twin, and run the query that separates them. Map the chain from initial Execution The attacker successfully runs malicious code on a system, typically using interpreters, scripts, payloads, or legitimate tools. to external communication before Lateral Movement Adversary traversal from the initial-access host to other hosts inside the environment. Each hop expands the blast radius and adds new entities for Subject analysis. Often piggybacks on legitimate authentication, which is what makes it hard to detect. widens it. Containment The incident-response phase between detection and eradication: isolate the affected hosts, revoke the compromised credentials, block the C2 destinations, freeze the situation so it stops getting worse while the investigation continues. is a criteria decision, not an inevitability: it triggers when escalation criteria confirm, not whenever traffic looks strange.
Next up
File system activity
Persistence, payload deployment, ransomware staging, exfiltration preparation. Tracking the file lifecycle and its metadata.
Read file system