Network Traffic Detection Indicators

Passive NDR engines monitor the application layer of an SMB session to track three critical variables: the active SMB protocol version, the explicit share paths being called, and associated file write/read metrics. While a routine administrator connection rarely triggers unexpected application binaries, an adversarial pivot frequently pairs share access with immediate tool compilation. For instance, detecting an active ADMIN$ session immediately followed by a file operation involving unapproved execution layers (such as a local python.exe deployment) serves as a high-fidelity indicator of compromise.

Investigation Checklist

• Initiator Verification: Correlate the source IP address against authorized administrative jump hosts and active change management logs.
• Post-Access Triggers: Audit the connection payload to check whether the share access was immediately followed by binary file drops or unauthorized script staging.

Network Traffic Detection Indicators

PSExec leaves a distinct signature in network traffic due to its underlying mechanics. Every execution begins by establishing a connection over SMB port 445 to the target’s IPC$ share, followed immediately by installing and starting a temporary Windows service named PSEXESVC. Because this traffic is transmitted in clear text over the wire, an NDR platform can read the exact command string passed to the remote host, providing direct evidence of adversarial intent.

Investigation Checklist

• Operator Authentication: Flag any instances of PSEXESVC initialization executing outside standard operational maintenance hours or on endpoints with no historical record of remote administration.
• Command String Extraction: Inspect the parsed application metadata to analyze the exact command string executed by the service, prioritizing any obfuscated strings or unmapped binary calls.

Network Traffic Detection Indicators

Because RDP session traffic is encrypted natively, security analysts cannot directly inspect in-session keystrokes or file actions from network flows alone. Investigation must therefore pivot to analyzing connection metadata, tracking variables like source-destination IP pairs, session durations, and geographic origin indicators.

Session duration metadata provides deeper insights than most analysts realize. While a brief internal RDP session might appear benign, it must be evaluated alongside the prior activity baseline of the initiating host. If that host demonstrated anomalous system queries or unmapped database access immediately before opening the RDP session, the connection is likely part of a lateral chain. Analysts can leverage peer graphing to trace every internal endpoint the host interacted with immediately after the session ended to define the complete blast radius.

Investigation Checklist

• Pre-Session Host Baseline: Analyze the historical activity of the source device to determine if unusual communication trends or scanning behavior preceded the session.
• Downstream Peer Graphing: Leverage network peer graphing to map out and audit every subsequent internal connection initialized by the target host after the RDP session closed.

Network Traffic Detection Indicators

An attacker can exploit this behavior by running tools like Responder to listen for these multicast queries on UDP port 5355. The attacking device sends a spoofed unicast response claiming to be the target host, forcing the victim machine to attempt authentication and transmit its NTLM credential hash over the wire. A legitimate LLMNR exchange occurs exclusively between a client and a valid asset holder; detecting a unicast response originating from an unexpected IP address with no prior communication history indicates an active poisoning attempt.

Investigation Checklist

• Responder Validation: Compare the IP address of the unicast responder against the authoritative hostname registry, and flag any nodes attempting to answer queries for unmapped domains.