How can security teams detect SLOWDRIFT?

What SLOWDRIFT looks like in telemetry

SLOWDRIFT is easier to find when you stop looking for a single obvious event and instead look for a pattern that repeats quietly over time. The signal is usually low-volume and routine-looking: periodic outbound contact, short bursts of execution, and persistence that keeps a host returning to the same external destinations or local trigger conditions.

The practical issue is that this kind of activity often hides inside normal background noise. A host may only generate a few connections per hour, use a browser-like user-agent, or wake up on a timer that appears consistent with update checks, scheduled tasks, or legitimate maintenance. Detection works best when you treat those weak signals as a cluster rather than as isolated anomalies.

Telemetry and baselining checks that matter

Endpoint telemetry should be reviewed for processes that reappear after reboot, scheduled task activity, unusual services, registry run keys, cron entries, or other persistence points that keep execution alive. Network telemetry should be checked for rare domains, low-and-slow DNS or HTTPS traffic, repeated small sessions to the same infrastructure, and user-agent strings that do not match the host's normal software stack.

Baseline comparison is essential because SLOWDRIFT-style behaviour is often only suspicious relative to peers. Compare similar hosts by role, image, department, and normal traffic volume so you can spot a workstation that contacts the outside world at regular intervals when its peers do not. A good baseline also helps separate maintenance beacons from truly irregular callback patterns.

Reviewing malware detection methods and evasion patterns can help analysts interpret these weak signals, especially when the activity blends into normal operations. The Malware Guide is useful here because it covers loaders, RAT behaviour, evasion techniques, sandbox analysis, and other patterns that often appear in low-visibility infections.

Why low-and-slow activity is easy to miss

SLOWDRIFT is designed to avoid the kinds of alerts that catch loud malware: failed logins, large exfiltration bursts, repeated crashes, or obvious command-and-control chatter. Instead, the operator or malware family tends to favor patience, low frequency, and small payloads so the activity looks like routine business traffic or scheduled administration.

MITRE ATT&CK Enterprise Matrix is a useful reference point for mapping those behaviours to credential access, persistence, and evasive execution patterns, while SANS Security Resources provides practical detection-engineering and SOC workflows that help analysts turn weak indicators into a triageable lead.

The key defensive mistake is to dismiss repeated low-volume contact as benign simply because it is small. Persistence, periodic callbacks, and unusual process timing become meaningful when they line up across multiple telemetry sources. If one host alone looks odd, it may be noise; if endpoint, DNS, proxy, and process data all tell the same story, you have a stronger case for investigation.

Practitioner Guidance

What to prioritise: Start with the hosts that combine periodic external contact and any form of persistence, then check whether the same pattern appears across a small cluster of similar systems. That combination is more actionable than a single strange connection or a one-off scheduled task.

What to verify: Confirm whether the outbound destinations are rare for your environment, whether the timing is mechanically regular, and whether the initiating process matches the expected software inventory. If the answer is no on more than one of those checks, treat the host as suspicious even if the traffic volume is low.

Common mistake: Do not overfit to the exact beacon interval or a single indicator of compromise. Low-and-slow activity often shifts timing, rotates infrastructure, or changes user-agent strings precisely to defeat rigid detections, so the hunt logic should focus on pattern consistency rather than one signature.

Practitioner takeaway: The most reliable SLOWDRIFT hunts correlate timing, persistence, and rare external contact across endpoint and network data, because each signal alone is often too weak to trust.

Related resources from NHI Mgmt Group

• Why are NHIs a critical concern for security teams?
• What steps should security teams take to prevent Shadow AI risks?
• Why is the abuse of NHIs a priority for security teams?
• What is the difference between SAST and DAST for security teams?