M ManySignal

Attack Surface: Network

Network attack surface

The network event shows a suspicious connection to port 443. Without identity context, it's noise. ManySignal resolved the source IP to a privileged admin account active at 3 AM, making it a P1 incident.

Book a demo Command and control
Attack surface map

Network threats need identity context to become actionable

External perimeter

T1190

Port scanning, vulnerability exploitation, brute force

C2 communication

T1071

Encrypted beacon traffic to attacker infrastructure

DNS layer

T1071.004

DNS exfiltration, DGA domains, DNS tunneling

East-west traffic

T1021

Lateral movement via SMB, RDP, WinRM, SSH

Egress channels

T1048

Data exfiltration over HTTP/S, DNS, ICMP, cloud storage

VPN and remote access

T1133

Credential-based VPN compromise, split tunneling abuse

Top 5 detection rules

1
JARM fingerprint mismatch
TLS server fingerprint matches known C2 framework (Cobalt Strike, Sliver) regardless of IP reputation
2
DNS beacon pattern
Periodic DNS queries to same domain with timing regularity indicating automated check-in
3
East-west service sweep
Single host attempting connections to multiple internal hosts across multiple service ports
4
Large DNS response exfiltration
DNS TXT response significantly larger than baseline for domain, potential DNS tunneling
5
VPN authentication without MFA from new location
VPN login from IP not in user's geolocation history without second factor
Network + identity correlation 
enrichment: network_event + identity_context
on_network_alert:
  resolve_identity:
    - dhcp_logs: ip -> hostname -> user (via domain auth)
    - vpn_auth: ip -> authenticated_user
    - nac_records: mac_address -> device -> owner
  add_context:
    - user.role: admin / standard / privileged
    - user.auth_status: mfa_complete / mfa_exempt / risky
    - user.recent_alerts: last_30_days threat_indicators
    - device.compliance: managed / unmanaged / unknown
    - baseline.normal_destinations: user's typical peers
  score_adjustment:
    - privileged_user: +40% severity multiplier
    - off_hours: +25% severity multiplier
    - new_destination: +30% severity multiplier
    - unmanaged_device: +35% severity multiplier

Related use cases

Command and control Lateral movement Data exfiltration Ransomware early warning

Network attack surface FAQ

Does ManySignal replace NIDS or NIPS solutions?

ManySignal is complementary to NIDS/NIPS rather than a replacement. ManySignal ingests alerts from existing network detection tools (Zeek, Suricata, Palo Alto Cortex, Cisco Secure NDR) and enriches them with identity context, behavioral baselines, and threat intelligence. The combination of network detection accuracy with identity correlation significantly reduces false positives compared to network-only alerting.

How does ManySignal correlate network events with identity?

ManySignal maintains a network-to-identity mapping by correlating DHCP logs, VPN authentication events, NAC records, and directory service lookups. When a suspicious network event occurs, ManySignal resolves the source IP to an authenticated user identity, their role, their historical network behavior, and their current security posture — transforming a network IOC into a user investigation.

Can ManySignal detect command and control traffic that uses legitimate protocols?

Yes. ManySignal's C2 detection goes beyond IP and domain reputation to analyze traffic behavior: DNS query patterns (volume, entropy, subdomain length), TLS certificate characteristics (JARM fingerprints, self-signed certs, unusual SANs), HTTP beacon timing regularity, and protocol misuse (HTTP headers inconsistent with stated user agent). These behavioral signals detect C2 frameworks like Cobalt Strike, Sliver, and Brute Ratel regardless of their IP reputation.

How does ManySignal handle encrypted traffic inspection for threat detection?

ManySignal uses metadata analysis (TLS fingerprinting, JA3/JA3S hashes, traffic timing, certificate details) rather than decryption. For environments with TLS inspection in place, ManySignal can also ingest decrypted traffic metadata. Additionally, DNS-over-HTTPS monitoring and DNS exfiltration detection operate on the DNS layer independently of payload encryption.

How does ManySignal detect lateral movement across network segments?

ManySignal correlates east-west traffic logs with the identity of the source and destination hosts. Lateral movement patterns — SMB connections to hosts outside the source's normal communication peers, RDP sessions from workstations to servers, WMIC and PsExec-style remote execution — are detected by combining network flow data with endpoint process telemetry. The attack chain view shows the full lateral movement path from the initial compromise point through each hop.

Does ManySignal require network traffic mirroring or a dedicated sensor deployment?

ManySignal can operate on log-based network telemetry — NetFlow, VPC Flow Logs (AWS/Azure/GCP), Zeek logs, DNS query logs, and firewall logs — without requiring physical network access or traffic mirroring. For environments where full packet capture is available, ManySignal can ingest the parsed metadata. Log-based coverage is sufficient for the majority of lateral movement and C2 detection use cases.

How does ManySignal detect DNS-based data exfiltration?

ManySignal monitors DNS query logs for high-entropy subdomain patterns, unusual query volumes per domain, and queries to recently registered or rarely queried external domains. Data exfiltration via DNS tunnelling typically produces query volumes many times higher than normal resolution traffic and subdomain strings with encoding patterns. ManySignal's DNS exfiltration detection correlates query behavior with the process or user identity responsible for the queries.

Can ManySignal integrate with our existing network security tools like Palo Alto NGFW or Cisco Umbrella?

Yes. ManySignal has native integrations for Palo Alto Networks (firewall logs and Cortex alerts), Cisco Umbrella (DNS security events), Fortinet FortiGate, and Zscaler (proxy and cloud firewall logs). Alert ingestion from these platforms enriches network findings with identity context. Response integration allows ManySignal to push block rules back to supported firewall and proxy platforms as containment actions.

Turn network anomalies into identity-correlated investigations

DHCP, VPN, and NAC resolution puts a user behind every suspicious IP — transforming network noise into actionable alerts.

Book a demo Explore the platform