Security teams can detect Tomiris by examining endpoints for covert execution, persistence, and data collection activity paired with unusual outbound communications. Look for script abuse, newly created autoruns, suspicious parent-child process relationships, and access to sensitive local files. Network detections should focus on periodic beaconing and connections that do not fit the host’s normal role.
What to look for on endpoints when Tomiris is active
Detection starts with behavior, not a single signature. Tomiris activity is most visible when a host shows covert execution, persistence, and staged collection together, especially if the same machine also begins making unusual outbound connections. That combination helps separate routine administration from intrusion-driven activity and gives analysts a clearer hunt path across endpoint and network telemetry.
On the host, prioritize script abuse, unexpected autoruns, and parent-child process chains that do not fit the asset’s normal role. A workstation that launches interpreters, script engines, or compression utilities in an unusual sequence is often more informative than any one artifact alone. For deeper context on malware behaviors and evasion patterns, see Malware Guide.
Access to sensitive local files is another useful indicator because collection activity often leaves a short trail before exfiltration begins. Security teams should treat unusual reads from user profile data, document stores, browser data, or other locally sensitive locations as part of the same detection story, especially when they appear close in time to process creation or outbound connections.
How Tomiris shows up in network telemetry
Network detections should focus on periodic beaconing, low-volume repeated callbacks, and connections that do not match the host’s expected business function. The goal is to identify patterns that persist over time rather than isolated spikes, because beaconing often looks normal in small samples but becomes obvious when analyst timelines are compared against standard host behavior.
Analysts should also look for destinations or protocols that are uncommon for the role of the device. A finance workstation, engineering server, or user endpoint talking regularly to an unexpected external service is more important than a generic indicator because it ties the network event back to the host’s normal operating profile. Correlating endpoint execution with outbound traffic is what makes the detection operationally useful.
Tomiris detection is strongest when endpoint and network evidence reinforce each other. A process tree that shows script-based execution, followed by file access and then a stable outbound pattern, is materially more suspicious than any single event viewed alone. That is why hunt work should join process lineage, autorun changes, file activity, and network cadence in one timeline.
What a practical hunt workflow should verify first
Start with endpoint triage on systems that show new persistence, unusual scripting, or process ancestry that does not match the asset role. Then confirm whether those hosts also generate outbound connections at a regular interval or to destinations that are unusual for the environment. The most useful hunts test the relationship between local execution and remote communication, not each signal in isolation.
When you see likely collection behavior, verify whether the same host accessed high-value local files before the outbound activity. That sequence matters because it can distinguish reconnaissance or staging from ordinary administrative automation. If multiple hosts show the same pattern, compare them for shared tooling, common parent processes, or repeated destinations, which may indicate a broader campaign rather than an isolated infection.
Security teams should also keep detection logic tuned to role-based baselines. The same process or network behavior can mean very different things on a jump host, workstation, or server. The more clearly the baseline reflects the host’s job, the easier it becomes to surface Tomiris-style activity without flooding analysts with unrelated noise.
Risk and Threat Considerations
Tomiris-style activity is dangerous because the same foothold that enables covert execution can also support persistence, collection, and follow-on access. If the host is allowed to talk out freely, periodic beaconing can blend into normal traffic long enough for an operator to stage additional tooling or extract data.
Failure mechanism: The intrusion becomes harder to spot when endpoint activity is fragmented across script execution, autoruns, process lineage, and file access, while the network layer shows only small repeated callbacks.
Impact: Delayed detection increases the chance of continued data collection, broader internal reach, and more expensive containment because investigators must reconstruct the compromise after the fact.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1059 — Command and Scripting Interpreter | Tomiris detection hinges on script abuse and suspicious execution chains. |
| T1547 — Boot or Logon Autostart Execution | New autoruns are a core persistence signal in the detection approach. | |
| T1041 — Exfiltration Over C2 Channel | Periodic beaconing and unusual outbound traffic align with C2 and exfiltration behavior. | |
| Recommendation — Map script-like process activity to T1059 and hunt for abnormal interpreter use. Inspect autostart locations for unauthorized persistence under T1547. Correlate repeated callbacks with data transfer to detect C2-linked exfiltration. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and systems are monitored to detect potential cybersecurity events | The answer depends on continuous monitoring of endpoint and network telemetry. |
| DE.AE-03 — Event data are correlated from multiple sources and sensors | Detection requires correlating host behavior with outbound network patterns. | |
| Recommendation — Monitor endpoint and network telemetry for beaconing, persistence, and collection activity. Correlate endpoint, process, and network events to validate likely Tomiris activity. | ||
Practitioner Guidance
What to prioritize: Correlate process creation, autorun changes, and outbound cadence on the same host before you spend time on isolated indicators. A single suspicious file or connection is often less useful than a connected sequence of events.
What to verify: Confirm whether the host’s outbound destinations, timing, and process ancestry match its expected role. If they do not, treat the case as a likely intrusion path rather than a one-off anomaly.
Common mistake: Analysts often overfocus on one indicator class, such as network beaconing alone, and miss the local staging activity that explains why the host is communicating at all.
Practitioner takeaway: The most reliable Tomiris hunts join endpoint execution, persistence, file access, and outbound behavior into one timeline, because that cross-domain pattern is far harder to hide than any single artifact.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org