Two finance workstations that have never communicated before suddenly exchange SMB traffic at 3 a.m. No intrusion signature matched the traffic. Which detection approach is designed to flag this activity?
Select an answer to reveal the explanation.
Short Explanation
Your neighbor notices when a car that's never been on your street parks in your driveway at 3 a.m., even if it isn't on any wanted list. Behavioral detection works the same way: it knows what normal looks like and flags the new pattern. The trap is signatures and reputation, which only catch what's already known to be bad.
Full Explanation
Behavioral, or anomaly-based, detection builds a baseline of normal activity from telemetry such as flow records: which hosts talk to which, on what ports, at what times and in what volumes. New relationships or unusual timing and volume are scored as deviations and raised as alerts even when nothing matches a known pattern. Two peer workstations that have never communicated starting SMB sessions in the middle of the night is a classic lateral-movement indicator that this approach is designed to catch. Signature-based IPS rules detect known exploit content; the stem states that no signature matched, and ordinary SMB sessions using valid credentials may contain nothing malicious to match. Antivirus scanning on file servers inspects files for malware but would not see traffic between two workstations, nor flag a new communication pattern. Reputation lookups evaluate external destinations against threat intelligence; both endpoints here are internal and have no reputation history. Exam caveat: anomaly detection needs a learning period and produces some false positives, so tuning and context matter. Operational check: confirm flow telemetry covers the finance access layer, review the alert's baseline comparison, and pivot to the endpoint records on both workstations for the process that opened the SMB sessions.