Between alerts: What Attackers Do in the Spaces Ordinary Detection Misses
Summary: A Hacker News piece argues that SOC alerts rarely explain how an intrusion began or progressed, and that adversaries deliberately spread activity across quiet intervals, using valid credentials, LDAP queries, Kerberos service ticket requests, SMB and RDP sessions, and timed HTTPS or DNS exfiltration to blend into normal operations. It says adversaries may spend days or weeks inside an environment before generating a high-priority alert, and that AI is accelerating their reconnaissance and payload work while network detection and response telemetry is what lets defenders correlate the sequence.
Bottom line: If an attacker can dwell for days or weeks before tripping a single high-priority alert, the alert your team is triaging may be one event in a much longer chain, and the evidence needed to see that chain lives in network telemetry most SOCs never retain.
Read the original at The Hacker News ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026