If you are the sole security person at your employer, you have lots of competing demands for your attention.

Because of this, you don’t have much time even for the really important tasks; even things like actively looking for intrusions. Fortunately, intruders tend to follow some patterns that you can prioritize for monitoring. And because of your time constraints, you'll want to make this monitoring as quickly repeatable as possible.

Here are a few observations that may help you from the hundreds of intrusions that I’ve analyzed.

Initial Actions

Initial access is usually made through stolen/brute-forced credentials, a phishing email, or a missing patch. This means that an application or an account will suddenly start doing unusual things.

This activity frequently begins with commands to figure out where they are on the network, what kind of system they are on, and what kind of permissions do they have. For example, how often do you think Dave in Accounting uses the netstat command? (Answer: Never) The intruder needs to figure out what they have access to, so they will spend some time working on this.

Actively look for unusual behavior as much as you can and make the process of searching for it as quickly repeatable as possible.

Credentials and Network Discovery

Once the intruder has some information about the host they are on, they start looking for more credentials and hosts.

Adversaries have a goal beyond compromising a single host, so this is a logical step. They will try to reach hosts that have important data on them and collect additional credentials to use as they exploit the network further. Whether they are looking to ransom or steal data, they are going to need to find it first.

This type of activity is very common and is also important to hunt for. Again, make it as repeatable as possible.

Why Focus Here? 

Why did I decide to share these observations? Because they get you closer to the beginning of an intrusion rather than the end of it. If we can catch the adversary early on in an intrusion, then we can prevent an incident from turning into a data breach.