Lesson 10 of 10 · About 4 minutes
Spot unusual outbound traffic
Learn the concept.
An unfamiliar connection deserves a question, not an instant malware label. Compare its timing and destination with the program and task that produced it.
Investigate a repeated callback
Follow the sequence, or move one step at a time.
Reduced motion is on. Use Next step to explore without animation.
Read all 4 steps
- Identify the source
Start with the program and device associated with the alert.
- Compare the timing
The fictional records repeat every minute. A pattern is an observation, not yet an explanation.
- Check destination and baseline
Contrast this with approved updater traffic. Check destination, process history, and business use.
- Choose a supported next step
The destination remains unexplained. Preserve the evidence and follow the escalation playbook.
Similar repetition. Different context.
A fictional training example. Compare the observation with the conclusion.
| Process | Timing | Destination | Assessment |
|---|---|---|---|
| Updater | Hourly | Documented service | Matches approved maintenance |
| Downloaded program | Every minute | Unexplained destination | Needs investigation |
Read the visualA program contacts the same destination every minute. What does that establish?
Regular callbacks can be benign or suspicious. Investigate the context before choosing a conclusion.
Establish a baseline
Compare similar devices, expected services, timing, and traffic volume. Updates and monitoring agents can make regular connections too.
Connect traffic to a process
Use the available endpoint and network evidence to identify the source program, destination, and outcome. Check collection settings before interpreting missing events.
Build a supported conclusion
Attackers can use common web protocols for command and control. HTTPS and port 443 do not prove legitimacy, but repetition alone does not prove an attack either.
Put it in context
Fictional case: a signed updater contacts its documented service every hour. A newly downloaded program contacts an unexplained destination every minute while the user is idle. Investigate the second pattern by reviewing its process history, destination context, and permitted business use. Keep both observations separate from your hypothesis.
Make a decision.
Use what you just learned. A correct answer lets you save this lesson to your progress.
Take this with you.
Combine timing, destination, process, and context. No single traffic pattern tells the whole story.
Continue to the guided exercises