How can security teams detect Bonadan activity?

What Bonadan detection usually looks like in practice

Bonadan detection is usually pattern-based, not signature-only. The useful question is whether an endpoint, account, or service is behaving like a toolchain the organisation did not intend: scripted execution that launches other binaries, persistence that survives reboots, or host activity that is unusually “busy” for a system that should be quiet. That framing helps teams separate routine admin work from suspicious operator tradecraft.

The most reliable detections usually combine process, command-line, and parent-child relationships with host context. If PowerShell is spawning downloaders, schedulers, or living-off-the-land utilities in ways that do not match your approved administration model, that is stronger than any single alert. For threat mapping, the MITRE ATT&CK Enterprise Matrix remains the most useful reference for relating observed behaviour to privilege escalation, lateral movement, and credential access patterns.

Teams also need to look beyond the endpoint. If the host is making communications that do not match approved management tools or business software, that can indicate command-and-control, staging, or follow-on access activity rather than ordinary application traffic. The SANS Security Resources collection is a practical place to align those detections with incident-handling and SOC workflows.

Signals that matter more than a single alert

Bonadan-style activity is best detected by clusters of weak signals. A single PowerShell event, a single service creation, or a single failed login is rarely enough on its own. The stronger signal is a sequence: unusual execution, followed by persistence, followed by access to neighbouring systems, followed by traffic that does not fit the asset’s normal role.

Privilege escalation and lateral movement are especially important on systems that should be low-noise. A server that normally runs one or two expected services should not suddenly show interactive script execution, scheduled task abuse, remote service creation, or authentication attempts that suggest operator control. On the network side, look for beacon-like patterns, unusual destinations, and management-like channels that are not actually tied to sanctioned administration tools.

Identity telemetry improves confidence. When endpoint behaviour and network paths line up with new authentication events, privileged session changes, or unusual use of an administrator account, the case moves from suspicious activity to probable compromise. That is why Bonadan hunting should correlate across host, network, and identity rather than treating any one source as decisive.

How to reduce false positives without missing real compromise

The main challenge is that the same building blocks used by malware are also used by legitimate administrators. Security teams need an allowlist that is behavioural, not just binary. Approved remote management tools, sanctioned script repositories, and routine maintenance windows should be explicit, so detections can focus on deviations such as odd parent processes, unexpected working directories, or scripts launched from user-writable locations.

Context also matters. An activity pattern that is normal on a jump host may be highly suspicious on a file server, domain controller, or internet-facing system. Good detection engineering asks whether the behaviour fits the asset’s role, the user’s role, and the time of day. If all three are off, the signal deserves escalation even if the individual event looks mundane.

When organisations tune these detections, they should prefer high-confidence behavioural combinations over broad “suspicious script” rules. That keeps the queue usable and reduces alert fatigue while preserving the ability to spot a real intrusion chain early.

Risk and Threat Considerations

Bonadan activity matters because the same behaviours that enable discovery and execution also support persistence, privilege escalation, and lateral movement. If defenders only watch for one stage, an attacker can move from initial execution to broader control without triggering the narrow rule.

Failure mechanism: The compromise persists when scripted execution, service changes, and trust relationships are not correlated, allowing the actor to blend into normal admin noise and use legitimate management pathways to expand access.

Impact: Missed correlation can delay containment, increase the number of affected hosts and accounts, and expose credentials or administrative sessions that are then reused for broader intrusion.

Practitioner Guidance

What to prioritise: Start with systems that should be operationally quiet, such as servers with limited administration, and review whether their process tree, scheduled tasks, and outbound connections fit the host’s expected role. If the answer is no, treat the host as a high-priority investigation even before you have a confirmed malware family.

What to verify: Confirm whether the suspicious activity used an approved management tool, an approved admin account, or an expected automation path. If it did not, verify the preceding login trail, the privilege used, and whether the same chain appears on other hosts or adjacent accounts.

What good looks like: Mature detection produces a single investigative story across endpoint, network, and identity telemetry, so analysts can say not just “this looks odd” but “this process, this account, and this connection together indicate an unauthorized operator path.”

Practitioner takeaway: The best Bonadan detections are correlation-led, not alert-led, and they should answer one question quickly: does this behaviour fit the host, the account, and the approved management model, or does it look like hidden operator activity?

Related resources from NHI Mgmt Group

• Guide: Malware Guide
• Why are NHIs a critical concern for security teams?
• What steps should security teams take to prevent Shadow AI risks?
• Why is the abuse of NHIs a priority for security teams?
• What is the difference between SAST and DAST for security teams?