What to check
- Destination IP/domain.
- Port and protocol.
- Connection frequency.
- Bytes sent and received.
- Process that initiated the connection.
- DNS resolution.
- Asset role and user context.
RR CYBERLAB • Network Investigation
Suspicious Network Connections
Investigate unexpected network connections using destination, timing, process and asset context.
QUICK READ
An unusual connection is a lead, not a verdict. Analysts should establish whether the destination and behavior fit the host’s normal role.
Use this page after the daily quiz: learn the concept first, then follow the investigation workflow and examples.
Beaconing clues
- Repeated intervals.
- Similar connection sizes.
- Consistent destination.
- Long-lived or periodic sessions.
Example
A workstation makes a connection every 60 seconds to a rare external address. Combine network timing with process creation and DNS evidence before classifying it.Common mistakes
- Using IP reputation as the only evidence.
- Ignoring legitimate software update traffic.
- Failing to check the endpoint process.
Daily quiz hook
Which three data points are useful when investigating an unexpected outbound connection: destination, timing and initiating process?
Quiz flow: introduce this topic briefly on social media, ask the question, reveal the answer, then send learners here for the detailed investigation.
Analyst practice note
An unexpected connection becomes meaningful when tied to process, identity, host role, destination reputation, timing, and volume. Reputation services and geographic estimates can be stale or shared, so use them as context rather than verdicts.
In the lab, pivot from the connection to the process tree and DNS history. Compare expected business traffic and peer hosts before isolating a device; document why the response is proportionate.
Continue practicing: open a fictional mission and test your reasoning against the simulated evidence.