Network Data Exposes Hidden Attack Paths Between Alerts

"Adversaries might spend days or weeks inside an enterprise environment before an action generates a high-priority security alert," Corelight warns.

Silent progression: how adversaries blend with ordinary operations

The report lays out a simple but unsettling principle: when attackers want to avoid detection, they borrow what the business already relies on. Rather than obvious scans, adversaries "spread reconnaissance across hours or distributed sources," use compromised accounts to query domain controllers over LDAP at a modest pace, request a handful of Kerberos service tickets to crack offline, and leverage valid credentials to access SMB or RDP — the same services administrators use every day. Files can be collected on one internal system, compressed, and then exfiltrated later over HTTPS or DNS with timing variations tuned to resemble normal traffic.

Why alerts alone rarely tell the whole story

Security operations centers (SOCs) commonly see an intrusion first as a stack of smaller alerts: a matching malware hash, a spike in failed logins, or an endpoint agent flag. The report emphasizes that "when viewed through the SIEM dashboard, an attack often begins as a series of distinct events with related or overlapping timestamps." Pointedly, a high-priority alert often does not mark the start of a compromise — it is one event in a longer sequence. Analysts who investigate only the triggering alert risk missing the chained activity that explains how the intrusion developed.

Network detection and response (NDR): the telemetry that connects events

Corelight positions protocol-aware NDR as the element that converts slices into a timeline. Retaining "underlying network telemetry" lets analysts reconstruct who or what communicated, which protocols were used, timestamps for interactions, and how those interactions evolved. Rather than merely knowing that two systems exchanged traffic, protocol-aware data can show queries to unusual domains, internal authentications, SMB sessions to peers, and later outbound encrypted sessions — the sequence that turns benign-looking events into a coherent investigative picture.

AI-assisted SOCs: faster synthesis, broader searches

Artificial intelligence is changing the economics of incident investigation. The source notes that AI enables faster searches across breadth and time: AI-assisted SOCs "can search across that same breadth of evidence much faster, bringing relevant data into one view in minutes rather than hours." When AI handles synthesis, correlation and analysis can occur asynchronously, allowing analysts to review and query broader datasets sooner. For attacker tradecraft that deliberately plays out across long intervals — "hundreds of seemingly ordinary transactions" — the report argues the practical approach is to automate workflows in an NDR platform so AI agents can identify context and relationships before surfacing the evidence for human judgment.

What this means for technologists and security teams, procurement leaders, and adversaries

• Technologists and security teams: retain protocol-aware network telemetry and build automated NDR workflows so investigators can extend timelines beyond a single alert. Detailed network evidence enables correlation across hosts, users, protocols, and time rather than treating each alert as discrete.
• Procurement leaders and operations: prioritize platforms that deliver structured, explainable data. Corelight frames its NDR offering as producing "open, transparent, and explainable" evidence so both analysts and "agentic AI" can reason from preserved protocol-level context.
• Adversaries and threat actors: the same principles of stealth and exploitation described in the report explain why attackers will continue to exploit administrative tooling and routine services; defenders who lack retained network evidence leave those sequences unobserved.

Retain evidence, then let AI and analysts reason from it

The report's central recommendation is procedural: do not attempt to drown analysts in more alerts by lowering thresholds. Instead, preserve fine-grained network telemetry that gives automated workflows the material they need. With that evidence, AI agents can correlate activity over time, connect communications between systems, and surface sequences that would otherwise look innocuous. The claimed benefits are concrete: time savings, clearer insights through advanced algorithms, and better decisions because analysts focus on strategic risk judgments rather than picking apart individual alerts.

Corelight summarizes the argument bluntly: "Your AI SOC is only as effective as the data behind it." If defenders apply the same principle adversaries exploit — using routine tools and slow timing to hide — the SOC can find the riskiest activity by letting protocol-aware NDR supply the context AI and humans need to see the whole picture.

https://thehackernews.com/2026/10/between-alerts-what-attackers-do-in.html