3 ms·
Those are in known IP space, perhaps from well known IPs on corp-net. I think up-thread is talking about known-internal IP doing loads of traffic to new-untrus
by djbusby 4y ago
Those are in known IP space, perhaps from well known IPs on corp-net.
I think up-thread is talking about known-internal IP doing loads of traffic to new-untrusted IP which would indicate exfiltration.
- tatersolid 4y agoMost of the time the exfil doesn’t go to Russian IP space or anything like that. It goes to an S3 bucket controlled by the attacker, and looks exactly like backup or replication traffic. Network-layer security devices are pretty useless in 2023. Everything is encrypted and everything talks to everything else as part of “normal” operations.