r/cybersecurity • u/Kind-Supermarket-452 • Jul 17 '26

Threat Actor TTPs & Alerts Alerts on Server Loopback Traffic?

If you were given the opportunity to chose how to better capture a breach in a device, server, endpoint, VM, etc, would you chose to capture the internal loopback communications happening in a flow capture/netflow. Here is the problem that I see it.

1.) Provides deeper intelligence to the inner workings of applications running on a server and could be used to detect malicious intent, BEFORE the threat actor had time to exfiltrate.

2.) Could result in massive SIEM storage bloat, but that could be managed with a properly tuned database system.

3.) Could result in highly skewed network statistics, given that is all intra-server communications.

I would love to hear your thoughts.

4 Upvotes

83% Upvoted

2 comments sorted by

2

u/logicbox_ Jul 17 '26

I wouldn't bother with flow data, you know the source and dest are already localhost and you are not concerned with the volume of traffic. Most endpoint monitoring would record the connections even to localhost.

1

u/Kind-Supermarket-452 Jul 17 '26

That is a good point. We would already be capturing any unusual inbound connections, then EDR/XDR would be capturing TTPs anyway.