At some point, your security will fail. This is not pessimism; it is the operational reality that justifies every dollar invested in detection engineering. You deploy EDR, you tune SIEM rules, you harden perimeters, and yet—adversaries still get in. The question is no longer whether you can prevent the initial breach, but whether you can find and disrupt what got in before it achieves objectives.
The security industry has spent the last decade obsessing over prevention and alert generation. We have trained analysts to react to the alert—that binary moment when a control fails. But the alert is merely a notification, not a narrative. It tells you something happened, not what it means, where it came from, or where it is going.
This post examines why the modern SOC must shift from an alert-centric to a data-centric interdiction model. Specifically, we argue that rich network data—full packet capture, connection metadata, and DNS telemetry—provides the only ground truth that survives sophisticated evasion techniques targeting endpoint agents. We will explore how to build detections that survive adversary adaptation and provide actionable hunting logic to expose the command-and-control (C2) traffic and lateral movement that endpoint telemetry often misses.
Technical Analysis
The Limitations of Endpoint-Centric Detection
Modern adversaries have adapted to the prevalence of EDR. They operate in memory, leverage living-off-the-land binaries (LOLBins), and use encrypted C2 channels that mimic legitimate application traffic. Endpoint telemetry is valuable, but it is also subject to tampering. An attacker with administrative privileges can disable sensors, clear event logs, or inject false telemetry. The endpoint can lie.
The network, however, cannot lie. An attacker may spoof a process name or inject shellcode into a signed binary, but they cannot transmit data without traversing a network. Every beacon, every exfiltration stream, and every lateral movement connection leaves an indelible trace in the flow of packets.
The Interdiction Strategy
Interdiction is the operational phase between prevention and remediation. It assumes compromise and focuses on three key activities:
- Detection: Identifying anomalous behavior within the noise of legitimate traffic.
- Disruption: Blocking C2 channels and isolating compromised segments.
- Eradication: Removing persistence mechanisms and closing attack paths.
Rich network data enables this strategy by providing:
- Session Context: Understanding the five-tuple (source IP, destination IP, source port, destination port, protocol) plus timing and volume characteristics.
- Protocol Fidelity: Deep packet inspection (DPI) or protocol metadata (Zeek, Suricata) reveals malformed requests, unauthorized protocol tunneling (DNS over HTTPS anomalies, ICMP tunneling), and certificate irregularities.
- Historical Baseline: Unlike alerts that trigger on point-in-time events, network data allows you to retroactively hunt for indicators of compromise (IOCs) discovered weeks or months after the initial intrusion.
The Attack Chain Through a Network Lens
Consider a typical 2026 intrusion:
- Initial Access: Phishing or exploitation of a public-facing application. The endpoint agent may alert, or the payload may use fileless techniques to evade detection.
- Persistence: The attacker establishes a C2 channel using TLS 1.3 with certificate pinning or domain fronting. The endpoint may see
svchost.exemaking outbound connections, but the network sees a rare JA3/JA4 fingerprint or connections to low-reputation ASNs. - Lateral Movement: The attacker uses WMI, PsExec, or RDP to move laterally. Endpoint detection may be blind if the attacker uses stolen credentials. Network sensors see unusual SMB traffic patterns, RDP session anomalies, or Kerberos ticket requests from unexpected hosts.
- Exfiltration: Data is staged and encrypted. Network data reveals the volume spike, the destination country, and the TLS certificate used for the exfiltration channel.
By focusing on the network, you shift from chasing individual alerts to observing the behavioral signatures of the intrusion chain.
Detection & Response
Effective interdiction requires hunting for the specific network behaviors that indicate compromise, not just matching IOCs. Below are detection rules and hunting queries designed to expose the network artifacts of post-exploitation activity.
SIGMA Rules
The following Sigma rules target network-level behaviors associated with C2 traffic and lateral movement. These rules are designed for network sensor logs (Zeek, Suricata, or firewall logs) ingested into your SIEM.
---
title: Suspicious DNS Query Length and Frequency Anomaly
id: 8f3a2b1c-9e4d-4f67-a8b9-2c3d4e5f6a7b
status: experimental
description: Detects potential DNS tunneling or DGA-based C2 by identifying excessively long DNS queries or high-frequency queries from single hosts.
references:
- https://attack.mitre.org/techniques/T1071/004/
author: Security Arsenal
date: 2026/04/15
tags:
- attack.command_and_control
- attack.t1071.004
logsource:
category: dns
product: zeek
detection:
selection:
query|length:
- '>52'
condition: selection
falsepositives:
- Legitimate content delivery networks (CDNs) occasionally use long DNS names for load balancing.
- Some antivirus solutions use DNS for reputation checks.
level: high
---
title: TLS Certificate Anomaly - Self-Signed or Rare Issuer
id: 9a4b5c6d-1e2f-4a8b-9c0d-3e4f5a6b7c8d
status: experimental
description: Identifies TLS connections using self-signed certificates or certificates from rare issuers, common in adversary C2 infrastructure.
references:
- https://attack.mitre.org/techniques/T1573/
author: Security Arsenal
date: 2026/04/15
tags:
- attack.command_and_control
- attack.t1573.002
logsource:
category: ssl
product: zeek
detection:
selection_issuer:
issuer|contains:
- 'Internet Widgits Pty Ltd'
- 'Internet Widgits Pty'
selection_selfsigned:
validation_status: 'self signed certificate'
condition: 1 of selection_*
falsepositives:
- Internal development servers using self-signed certificates.
- Some legitimate IoT devices use self-signed certs (should be whitelisted).
level: medium
---
title: SMB Admin Share Access from Non-Admin Host
id: 7c8d9e0f-2a3b-4c5d-8e9f-1a2b3c4d5e6f
status: experimental
description: Detects lateral movement via administrative shares (C$, ADMIN$, IPC$) from workstations or servers not typically used for administration.
references:
- https://attack.mitre.org/techniques/T1021/002/
author: Security Arsenal
date: 2026/04/15
tags:
- attack.lateral_movement
- attack.t1021.002
logsource:
category: smb
product: zeek
detection:
selection:
path|contains:
- 'ADMIN$'
- 'C$'
- 'IPC$'
source_ip|cidr:
- '10.0.0.0/8'
- '172.16.0.0/12'
- '192.168.0.0/16'
condition: selection
falsepositives:
- Legitimate administrative activity from designated jump boxes or IT workstations.
- Vulnerability scanners performing authenticated scans.
level: high
KQL (Microsoft Sentinel / Defender)
These hunting queries assume you are ingesting Zeek or firewall logs into Microsoft Sentinel via the CommonSecurityLog or Syslog tables, or using Defender for Endpoint network events.
Hunt 1: Beaconing Behavior via JA3/JA4 Fingerprinting
// Identify potential C2 beaconing using TLS client fingerprinting
// Requires Zeek ssl.log or equivalent with JA3/JA3S fingerprints
CommonSecurityLog
| where DeviceVendor == "Zeek"
| where DeviceProduct == "SSL"
| where TimeGenerated > ago(24h)
| extend ja3_hash = tostring(split(AdditionalExtensions, "ja3=")[1])
| where isnotempty(ja3_hash)
| summarize count() by ja3_hash, DestinationIP, DestinationPort
| where count_ < 5 // Rare fingerprints
| join kind=inner (
CommonSecurityLog
| where DeviceVendor == "Zeek"
| where DeviceProduct == "Conn"
| where TimeGenerated > ago(24h)
| summarize ConnectionCount = count(), TotalBytes = sum(tolong(ResponseBytes)) by SourceIP, DestinationIP
| where TotalBytes < 1000000 // Low volume, high frequency (beaconing)
) on DestinationIP
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, ja3_hash, ConnectionCount, TotalBytes
| order by ConnectionCount desc
Hunt 2: DNS Tunneling Detection
// Detect DNS tunneling based on query length and entropy
Syslog
| where Facility == "dns"
| where TimeGenerated > ago(6h)
| extend QueryLength = strlen(QueryName)
| where QueryLength > 52
| extend Entropy = log2(QueryLength) * QueryLength
| where Entropy > 200 // High entropy threshold
| summarize QueryCount = count(), AvgLength = avg(QueryLength), UniqueQueries = dcount(QueryName) by SourceIP, Computer
| where QueryCount > 100 and UniqueQueries > 50
| project TimeGenerated, SourceIP, Computer, QueryCount, AvgLength, UniqueQueries
| order by QueryCount desc
Hunt 3: Lateral Movement via SMB Admin Shares
// Hunt for SMB admin share access patterns indicative of lateral movement
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where RemotePort == 445
| where RemoteUrl contains "ADMIN$" or RemoteUrl contains "C$"
| where not(RemoteUrl contains "sysvol") // Exclude GPO traffic
| summarize ConnectionCount = count(), UniqueTargets = dcount(RemoteIP) by DeviceName, InitiatingProcessAccountName
| where UniqueTargets > 5 // One host hitting many targets
| join kind=inner (
DeviceInfo
| where DeviceType == "Workstation" // Lateral movement from workstations is suspicious
) on DeviceName
| project DeviceName, InitiatingProcessAccountName, ConnectionCount, UniqueTargets, Timestamp=TimeGenerated
Velociraptor VQL
For endpoint validation of network findings, use Velociraptor to hunt for processes with suspicious network connections or memory artifacts associated with C2 frameworks.
-- Hunt for processes with suspicious outbound connections and unsigned binaries
SELECT
Pid,
Name,
Exe,
CommandLine,
Username,
netstat() as Connections
FROM pslist()
WHERE
-- Look for unsigned or unusual paths
(Exe =~ 'C:\\Users\\[^\\]+\\AppData\\Local\\Temp' OR
Exe =~ 'C:\\Windows\\Temp' OR
Exe =~ 'C:\\ProgramData')
AND
-- Exclude common legit paths
NOT Exe =~ 'C:\\Program Files'
AND
-- Check if process has outbound connections
len(list=Connections) > 0
-- Hunt for DNS tunneling artifacts in process memory
-- Requires yara scanning capability
SELECT
Pid,
Name,
CommandLine,
pe_info().Imports as Imports
FROM pslist()
WHERE
Name =~ 'powershell.exe' OR Name =~ 'cmd.exe' OR Name =~ 'wscript.exe'
AND (
'dnsapi.dll' in Imports OR
CommandLine =~ 'nslookup' OR
CommandLine =~ 'dig'
)
Remediation Script
The following PowerShell script audits local network configurations to identify suspicious DNS servers (common in C2) and checks for unauthorized administrative shares. Run this on endpoints flagged by network detections.
# Network Interdiction Audit Script
# Run on endpoints identified via network hunting
Write-Host "[+] Starting Network Interdiction Audit..." -ForegroundColor Green
# 1. Check DNS Server Configuration
Write-Host "[+] Checking DNS Configuration..." -ForegroundColor Cyan
$DNSServers = Get-DnsClientServerAddress -AddressFamily IPv4 | Where-Object {$_.ServerAddresses}
foreach ($DNS in $DNSServers) {
$Servers = $DNS.ServerAddresses
foreach ($Server in $Servers) {
# Flag non-RFC1918 DNS servers (potential rogue DNS)
if ($Server -notmatch "^10\." -and $Server -notmatch "^172\.(1[6-9]|2[0-9]|3[0-1])\." -and $Server -notmatch "^192\.168\.") {
Write-Warning "Suspicious DNS Server detected: $Server on interface $($DNS.InterfaceAlias)"
Write-Host " Recommendation: Investigate if this is authorized external DNS" -ForegroundColor Yellow
}
}
}
# 2. Check for Unauthorized Administrative Shares
Write-Host "[+] Checking Administrative Shares..." -ForegroundColor Cyan
$Shares = Get-SmbShare | Where-Object {$_.Name -match '^[A-Z]\$$' -or $_.Name -eq 'ADMIN$'}
foreach ($Share in $Shares) {
Write-Host " Found share: $($Share.Name) at $($Share.Path)" -ForegroundColor Yellow
}
# 3. Check Active Network Connections for Beaconing
Write-Host "[+] Checking for Beaconing Patterns..." -ForegroundColor Cyan
$Connections = Get-NetTCPConnection -State Established | Where-Object {$_.RemotePort -eq 443 -or $_.RemotePort -eq 80}
$Grouped = $Connections | Group-Object RemoteAddress | Where-Object {$_.Count -gt 10}
foreach ($Group in $Grouped) {
$IP = $Group.Name
$Count = $Group.Count
Write-Warning "High connection count to $IP ($Count connections) - possible beaconing"
# Reverse DNS lookup
try {
$Hostname = [System.Net.Dns]::GetHostEntry($IP).HostName
Write-Host " Hostname: $Hostname" -ForegroundColor Gray
} catch {
Write-Host " Hostname: Could not resolve" -ForegroundColor Red
}
}
# 4. Check for TLS Certificate Anomalies in Local Store
Write-Host "[+] Checking for Suspicious Certificates..." -ForegroundColor Cyan
$Certs = Get-ChildItem -Path Cert:\LocalMachine\Root | Where-Object {$_.Issuer -match "Internet Widgits" -or $_.Issuer -eq $_.Subject}
foreach ($Cert in $Certs) {
Write-Warning "Suspicious certificate in Root store: $($Cert.Subject)"
}
Write-Host "[+] Audit Complete" -ForegroundColor Green
Remediation
When network detections identify post-exploitation activity, immediate action is required to disrupt the attacker's operations.
Immediate Actions
- Isolate the Segment: Do not simply block the IP. Isolate the affected VLAN or subnet at the switch level to prevent lateral movement while preserving forensic data.
- Block C2 Infrastructure: Add identified malicious IPs and domains to your firewall block lists and DNS sinkholes. Use TLS fingerprinting (JA3/JA4) to block future connections even if the IP changes.
- Reset Credentials: If lateral movement is detected, force a password reset for all accounts that have authenticated to the compromised segment. Assume Kerberos tickets are compromised; purge the KDC ticket cache if necessary.
Architectural Hardening
- Implement Network Segmentation: Move away from flat networks. Use micro-segmentation to limit SMB/RDP traffic between workstations. Administrative shares should only be accessible from designated jump hosts.
- Enforce TLS Inspection: While privacy considerations exist, high-security environments should implement TLS inspection for north-south traffic to detect encrypted C2. At minimum, collect and analyze JA3/JA4S fingerprints.
- Deploy Network Detection and Response (NDR): If you rely solely on firewall logs, you are blind to east-west traffic. Deploy Zeek, Suricata, or commercial NDR solutions to capture protocol metadata.
- DNS Logging: Ensure all DNS queries are logged, including internal queries. DNS tunneling remains a preferred exfiltration channel because it bypasses many egress filters.
Long-Term Strategy
- Assume Breach: Design your detection strategy around the assumption that prevention has failed. Test this assumption quarterly with red team exercises focused on network-level evasion.
- Data Retention: Network metadata (NetFlow, Zeek logs) should be retained for at least 90 days to support retroactive hunting when new threat intelligence emerges.
- Baseline Normalcy: You cannot detect anomalies without knowing what normal looks like. Profile your network to understand baseline traffic patterns, administrative share usage, and DNS query volumes.
Conclusion
The alert is not the finish line; it is the starting gun. In 2026, adversaries expect to trigger alerts. They count on analysts lacking the context to distinguish signal from noise. By investing in rich network data and the analytical capability to interpret it, you shift the advantage back to the defender. The network does not lie. It is time we started listening.
Related Resources
Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.