Cybertek-Detection-Scripts/network_traffic_monitor/project.md

Project: Network Traffic Monitor

Summary

A self-contained PowerShell script that runs hourly via Syncro RMM and monitors active network connections for malicious activity on Windows endpoints.

The script performs multi-layer behavioral analysis using live threat intelligence feeds, reputation APIs, and local heuristics. Results accumulate between runs via a local state file to track recurring activity.

---

Business Problem

Malware, data theft, and command-and-control activity all generate network traffic. Traditional antivirus misses many threats that communicate over encrypted channels or use legitimate infrastructure. This script gives Cybertek continuous, low-cost visibility into outbound connection behavior — surfacing suspicious IPs, domains, and processes before they become incidents.

---

Detection Layers

Layer	Description
Threat intel blocklists	IPs, CIDRs, and domains pulled from the Cybertek threat intel repo (Feodo Tracker, Emerging Threats, Spamhaus DROP/EDROP, URLhaus)
AbuseIPDB enrichment	Per-IP reputation scoring via AbuseIPDB v2 API (cached 24h)
LOLBin correlation	Living-off-the-land binaries and scripting engines making external connections flagged as Critical
Port analysis	Connections to known-bad ports flagged as Warning
Exfil indicators	High outbound connection volume from the same process to the same destination
DNS cache monitoring	High-entropy domains, suspicious TLDs, domains resolving to blocked IPs

---

Architecture

• Language: PowerShell 5.1+
• Runtime: Syncro Windows script runner (SYSTEM context)
• Schedule: Hourly
• Threat intel source: github.com/cybertek605/cybertek-threat-intel (aggregated hourly)
• Alert method: Rmm-Alert with category network_traffic_critical or network_traffic_warning

Local Storage

Path	Purpose
C:\ProgramData\Cybertek\NetworkMonitor\state.json	Accumulated findings between runs
C:\ProgramData\Cybertek\NetworkMonitor\abuseipdb_cache.json	AbuseIPDB reputation cache (24h TTL)
C:\ProgramData\Cybertek\NetworkMonitor\blocklists\	Cached threat intel feed files

---

Syncro Script Variables

Variable	Required	Description
abuseipdb_api_key	No	AbuseIPDB v2 API key. Without it, API enrichment is skipped and local heuristics + blocklists still run.

---

Alert Categories

Category	Trigger
network_traffic_critical	Confirmed malicious IP/domain match, LOLBin with external connection, or exfil indicator
network_traffic_warning	Suspicious activity warranting review but below critical threshold

---

Files

network_traffic_monitor.ps1

Production-ready Syncro script. Multi-layer network threat detection with threat intel blocklists, AbuseIPDB enrichment, LOLBin correlation, port analysis, exfil indicators, and DNS anomaly detection.

---

Deployment

1. Import network_traffic_monitor.ps1 into Syncro as a PowerShell script.
2. Optionally add abuseipdb_api_key as a Script Variable.
3. Schedule hourly via Syncro policy.
4. Monitor alerts under network_traffic_critical and network_traffic_warning categories.