Network indicators: beaconing, unusual bandwidth, irregular peer-to-peer traffic, rogue devices, scans, unexpected ports

Network indicators are patterns in traffic that suggest compromise. They matter because malware almost always has to communicate: to receive commands, to spread, or to send stolen data out. You find these patterns in firewall logs, NetFlow or similar flow records, proxy and Domain Name System (DNS) logs, and packet captures. Most network indicators only make sense against a baseline, meaning a picture of what normal traffic looks like for that host, subnet or time of day.