Network Intrusion Prevention Systems

A subject can access the web with an organization device.

A subject is able to access external FTP servers.

A subject is able to access external SSH servers.

A subject conducts a scan of a network to identify additional systems, or services running on those systems.

The subject installs and uses an unapproved VPN client, potentially violating organizational policy. By using a VPN service not controlled by the organization, the subject can bypass security controls, reducing the security team’s visibility into network activity conducted through the unauthorized VPN. This could lead to significant security risks, as monitoring and detection mechanisms are circumvented.

The subject intentionally weakens or bypasses network security controls for a third party, such as providing credentials or disabling security controls.

A subject may employ a Python-based listening service to exfiltrate organizational data, typically as part of a self-initiated or premeditated breach. Python’s accessibility and versatility make it a powerful tool for creating custom scripts capable of transmitting sensitive data to external or unauthorized internal systems.

In this infringement method, the subject configures a Python script—often hosted externally or on a covert internal system—to listen for incoming connections. A complementary script, running within the organization’s network (such as on a corporate laptop), transmits sensitive files or data streams to the listening service using common protocols such as HTTP or TCP, or via more covert channels including DNS tunneling, ICMP, or steganographic methods. Publicly available tools such as PyExfil can facilitate these operations, offering modular capabilities for exfiltrating data across multiple vectors.

Examples of Use:

• A user sets up a lightweight Python HTTP listener on a personal VPS and writes a Python script to send confidential client records over HTTPS.
• A developer leverages a custom Python socket script to transfer log data to a system outside the organization's network, circumventing monitoring tools.
• An insider adapts an open-source exfiltration framework like PyExfil to send data out via DNS queries to a registered domain.

Detection Considerations:

• Monitor for local Python processes opening network sockets or binding to uncommon ports.
• Generate alerts on outbound connections to unfamiliar IP addresses or those exhibiting anomalous traffic patterns.
• Utilize endpoint detection and response (EDR) solutions to flag scripting activity involving file access and external communications.
• Inspect Unified Logs, network flow data, and system audit trails for signs of unauthorized data movement or execution of custom scripts.