Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I had been reading a blog post on trapx.com about how they go about threat analysis and following statement was made; "advanced attackers no longer perform noisy network scans. If they do network scans at all, they avoid detection by using single-packet connect requests on well-known ports, at an extremely slow rate".
How does one perform a single-packet connect request at an extremely slow rate? Is it possible to do this using nmap, if so how can it be done?
It simply means to do something like try a single connection attempt to a single port with a lot of time between.
But what "slow" means and how much time is not defined. 1/hr? 1/day? It depends on how stealthy the person wants to be and what their goals are.
nmap has many config options to do this (read the manual: https://nmap.org/book/man-performance.html)
For instance: T0 sends a single connection attempt to one port at a time with 5 minutes in between. There are numerous finer config options where you can define exactly what you want to do.
I challenge the statement that noisy network scans are not performed by advanced hackers. It really depends on the situation. There is no reason to go slow on a public IP. Internal IPs, once you are inside and re-enumerating, would need this, but this is not something that only advanced attackers would do. It's just a response to the reality that noisy scans would be discovered and so would the attacker. Typically, the attacker would listen to traffic or do other enumerations to get a sense of what servers are available and what they serve.
