Recognising an attack while it is underway is possible, but the volume and variety of signals across a network require more than manual observation alone. Here are the signals to look for and how to interpret them.
How to recognise an ongoing cyberattack: interpreting network signals
An attack becomes visible when the signals it leaves are correlated and compared with the network’s normal behaviour.
A single anomaly does not, by itself, indicate a compromise: it must be interpreted within the context in which it occurs. An access outside normal working hours, for example, could be due to scheduled maintenance. The assessment changes when additional evidence emerges:
- an indicator of compromise (IoC), such as a source IP address already associated with hostile infrastructure;
- other behavioural signals, such as repeated authentication attempts or access to resources that the account has never used before.
IoCs and anomalies provide different kinds of evidence. Correlating them helps reconstruct the context of the observed activity and strengthens the hypothesis of an ongoing attack.
The need to understand this context grows with the attack surface, rather than the size of the company.
Discover how NDR works and how it helps identify signs of a threat in network traffic.
Signals across the progression of an attack
Following signals as an attack progresses, with the support of frameworks such as MITRE ATT&CK, helps connect behaviours observed at different stages.
Network visibility adds the context needed to recognise relationships and anomalies that, when considered separately, might not indicate a compromise.
Recognising these signs early can help prevent significant damage and take appropriate security measures.
| Observed stage | Signals to investigate | What they may indicate |
|---|---|---|
| Access and identity use | Unusual access and authentication from unexpected sources or devices: abnormal credential use and unauthorised access to new resources. | Use of compromised credentials or a deviation from the user’s normal behaviour. |
| Discovery and lateral movement | New internal connections, unexpected use of remote services, access to unusual network segments or communication between systems that do not normally interact. | An attempt to explore the infrastructure, reach other resources or move laterally. |
| Changes to the environment | Unusual changes to systems, files or permissions, abnormal system events and unexpected changes to roles, privileges or access rights. | An attempt to expand access, alter how systems operate or maintain a presence in the environment. Possible privilege escalation. |
| External communications and data exfiltration | Unusual communications with new destinations, periodic connections and unexpected volumes of outbound traffic. | A Command and Control (C2) channel or an attempt to exfiltrate data. |
The contribution of Network Detection and Response
Network Detection and Response tools, or NDR, continuously monitor traffic and compare events against statistical models of normal network behaviour.
Their adoption has often been limited by several factors:
- The need for staff and specialist expertise.
- High deployment and management costs.
- Lengthy, complex installations and the resulting operational downtime.
Many NDR solutions also limit their role to generating alerts and orchestrating response through other tools.
These and other factors have largely restricted NDR adoption to enterprise organisations.
The value of NDR is clear: detecting suspicious activity while it is underway can reduce the risk of it reaching critical systems and causing operational disruption.
LECS was designed with these limitations in mind, aiming to make NDR capabilities accessible beyond enterprise organisations and provide network visibility and threat response in real time.
Frequently asked questions about network monitoring
What does network traffic monitoring allow you to see?
Network traffic monitoring makes it possible to observe how devices, users and systems communicate, both within the network and with external destinations. It helps identify unusual access, unexpected connections, lateral movement, C2 communications and potentially abnormal data transfers, including activity involving assets on which an agent cannot be installed.
Shouldn’t firewalls, antivirus software and EDR already detect these signals?
Firewalls, antivirus software and EDR are necessary, but they observe different layers. A firewall controls traffic passing through the points where it is configured, while antivirus software and EDR protect the endpoints on which they are installed. They can therefore detect some signals, but they do not always reconstruct what happens between all devices on the network, particularly when OT, IoT, legacy systems or devices that cannot run an agent are involved.
What is NDR technology, and how does it differ from other security tools?
Network Detection and Response technology continuously analyses network traffic to identify anomalies, correlate events and reconstruct the context of suspicious activity. Its main distinction is its observation point: rather than focusing on the perimeter or an individual endpoint, it examines communications and relationships between systems.
Does NDR only generate alerts, or can it also act on a threat?
It depends on the technology. Some NDR solutions report suspicious activity and leave the response to operators or other tools, such as firewalls, EDR and SOAR. Others integrate direct response capabilities. LECS, for example, can apply automatic, granular countermeasures proportionate to the anomalous communication, according to the defined configurations.
Is NDR useful for an SME, or only for large companies with a SOC?
The need for visibility depends on the attack surface, the number and variety of connected assets and the impact of a potential disruption, rather than company size alone. An SME can also have mixed networks, devices that cannot run an agent and essential processes. Limited staffing makes automation and ease of management particularly relevant.
Does adopting NDR require specialist staff, complex installations or operational disruption?
Traditional NDR solutions may require planning, integrations, tuning and specialist expertise. However, this is not an inevitable consequence of the technology. LECS was designed to operate alongside the network, without agents installed on assets: once traffic mirroring through a mirror port, SPAN or TAP has been configured, a typical installation takes approximately 10 minutes and does not interrupt normal business network traffic.
