3 ms·
Yeah but a socket connection to an IRC server and port will probably trigger a network monitoring firewall that a computer in the network has been compromised..
by netsharc 3y ago
Yeah but a socket connection to an IRC server and port will probably trigger a network monitoring firewall that a computer in the network has been compromised... A connection to arstechnica.com, the IT admin might even think "Cool, I didn't know that Bob from accounting is into tech..."
- willcipriano 3y agoCorporate firewalls throw so many alerts that it's unlikely that a human even sees it let alone looks into it.
- jcrawfordor 3y agoMost corporate SOCs would probably investigate IRC connections at least briefly, they have a very high signal to noise ratio for compromised devices. Modern security devices do generate a tremendous amount of information, but the security operations industry as a whole and SIEMs in particular were developed to make it feasible to risk score and triage these findings.
- willcipriano 3y agoThis is quite the opposite of all my personal experience.
- jdietrich 3y agoA well-configured corporate firewall is going to block anything that looks like an IRC packet, because for the overwhelming majority of users, the probability of that packet being malicious is ~1.