Full Report
With nearly 80% of cyber threats now mimicking legitimate user behavior, how are top SOCs determining what’s legitimate traffic and what is potentially dangerous? Where do you turn when firewalls and endpoint detection and response (EDR) fall short at detecting the most important threats to your organization? Breaches at edge devices and VPN gateways have risen from 3% to 22%, according to
Analysis Summary
# Tool/Technique: Multi-Layered Network Detection Strategy (NDR Focus)
## Overview
This summary describes a multi-layered detection strategy, heavily relying on Network Detection and Response (NDR) capabilities, adopted by Security Operations Centers (SOCs) to combat increasingly evasive threats, especially malware-free attacks and living-off-the-land techniques that bypass traditional Endpoint Detection and Response (EDR) solutions. The strategy aims to expose activity that adversaries attempt to conceal by leveraging network visibility.
## Technical Details
- Type: Technique / Detection Framework
- Platform: Network Infrastructure (Applies across platforms visible on the network)
- Capabilities: Exposure of evasive, malware-free, and zero-day threats by monitoring network traffic; improved visibility beyond what EDR provides, especially for edge device breaches.
- First Seen: The article suggests this approach is the response to 2025 threat trends.
## MITRE ATT&CK Mapping
Since the article describes a *detection strategy* rather than a specific offensive tool, the mappings correlate to the goals of detecting the associated attack behaviors.
- **TA0005 - Defense Evasion**
- T1027 - Obfuscated Files or Information (Detecting obfuscation bypassed by behavioral means)
- T1070 - Indicator Removal on Host (Network artifacts related to cleanup may be visible)
- **TA0011 - Command and Control**
- T1071 - Application Layer Protocol (Detecting C2 communications via behavioral analysis)
- T1105 - Ingress Tool Transfer (Detecting transfer of illicit files)
- **TA0008 - Lateral Movement**
- T1021 - Remote Services (Detecting unusual remote management traffic)
## Functionality
### Core Capabilities
The strategy involves layering detection methods, with network data providing visibility where endpoint solutions fail:
1. **Base Layer (Quick Detection):** Signature-based network detection (e.g., Proofpoint ET Pro on Suricata) and Threat Intelligence (IOC matching on network entities).
2. **Malware Layer:** Identification of malware payloads using static file analysis standards like YARA rules.
3. **Adaptive Layer (Sophisticated Detection):** Behavioral analysis (detecting DGAs, C2 communications, data exfiltration patterns), Machine Learning (supervised/unsupervised for known and novel threats), and Anomaly Detection (spotting deviations from baseline activity, e.g., unusual services, suspicious logins).
4. **Query Layer:** Search-based detection using direct queries on existing network logs.
### Advanced Features
- **NDR Superiority:** Effective in detecting threats that use legitimate tools maliciously or those exploiting edge devices/VPN gateways, where EDR struggles.
- **Evasion Resilience:** Behavioral components effectively detect evolving threats even when IOCs change.
## Indicators of Compromise
The strategy detects general classes of IOCs rather than specific, static indicators:
- File Hashes: N/A (Focus is network behavior, though YARA rules for malware involve hashes/file structures).
- File Names: N/A
- Registry Keys: N/A
- Network Indicators: Domain Generation Algorithms (DGAs), command and control communication patterns, unusual data exfiltration flows, unexpected connections to external entities.
- Behavioral Indicators: Unusual client software usage, anomalous management traffic, deviations from baseline network behavior.
## Associated Threat Actors
The strategy is positioned as necessary to counter **elite SOCs** dealing with sophisticated threats, including those employing:
- Credential theft
- DLL hijacking
- Living-off-the-land techniques
- Malware-free attacks (approx. 80% of detected threats cited in CrowdStrike's 2025 report)
## Detection Methods
- **Signature-based network detection:** Using industry signatures (e.g., Proofpoint ET Pro/Suricata).
- **Threat Intelligence:** Matching network entities against known IOC lists.
- **YARA rules:** For static file analysis/malware identification during payload drops.
- **Behavioral detection:** Identifying C2, DGA, and exfiltration behaviors.
- **Machine Learning:** Supervised and unsupervised models to identify anomalies and known patterns.
- **Anomaly detection:** Unsupervised ML spotting deviations from baseline network activity.
- **Search-based detection:** Direct log queries.
## Mitigation Strategies
- Adopting a **multi-layered detection** approach centered on network insights.
- Implementing **Network Detection and Response (NDR)** solutions to complement EDR.
- Leveraging **Corelight's integrated Open NDR Platform** (built on Zeek®) to consolidate seven network detection types.
- Minimizing attacker dwell time through rapid detection and AI-driven triage.
## Related Tools/Techniques
- EDR (Endpoint Detection and Response) - traditional solution that is being supplemented.
- Proofpoint ET Pro / Suricata (Used for signature-based detection).
- YARA rules (For malware structure identification).
- Zeek® (Foundation for the Corelight Open NDR Platform).
- Network Detection and Response (NDR) - The core technology advocated.