Look for unusual combinations of internet-exposed login pages, ephemeral-port HTTP activity, short hex-only responses, and logins that originate from home or small-office devices. Those signals are stronger when they appear across IdP, VPN, and proxy telemetry rather than in a single tool. The goal is to identify relay behavior, not just malware hashes.
How to spot relay behavior from edge devices
Teams should treat relay detection as a correlation problem, not a single-signal hunt. A compromised appliance often leaves a mixed trail: a web login surface that should not be busy, unusual outbound use of high or ephemeral ports, terse hex-like responses, and authentication events that look like they came from residential or small-office networks rather than normal admin locations.
The strongest detections are the ones that join identity, VPN, and proxy logs into one sequence. A device acting as a relay may look quiet in endpoint telemetry, yet its network and authentication footprint becomes inconsistent when the same source begins handling access for other systems or users.
Good detection logic therefore looks for behavior that changes the device’s role, not just for malware indicators. If the edge device starts behaving like a transit point, the evidence usually appears in how it accepts login traffic, how it forwards traffic, and where the originating sessions appear to come from.
Why single-tool alerts miss compromised relays
Relay activity is easy to miss when teams inspect one log source in isolation. A proxy view may show only normal forwarding, a VPN view may show only valid credentials, and an IdP view may show only successful logins. The compromise becomes visible when those events are linked and the access path no longer matches the expected operator pattern.
That is why analysts should build detections around cross-plane consistency. If a supposedly managed edge device accepts administrative access and then begins servicing traffic patterns that resemble ad hoc tunneling or session handoff, the question is not whether a hash is known. The question is whether the device is being used to move or relay access.
This is also where remote-access hygiene matters. NHIMG’s Remote Access Identity Guide is useful because it frames VPN, MFA, posture, and dormant-account control as part of the same trust boundary. For edge relay detection, that boundary is often where the first abnormal signal appears.
What telemetry patterns deserve immediate triage
Prioritise combinations, not isolated anomalies. An exposed login page is more concerning when it is paired with short-lived HTTP activity on ephemeral ports, especially if the responses are small, repetitive, and hex-only. Those traits often indicate automation, handshake testing, or relay tooling rather than normal user browsing.
Also verify whether source geography and client type make sense. Logins that originate from home or small-office devices can be perfectly legitimate, but they become suspicious when they coincide with access to an internet-facing appliance that should mostly see admin traffic from managed corporate networks. The pattern is especially important when the same source appears in IdP, VPN, and proxy logs in a tight time window.
Compromised edge devices are often used because they sit at the boundary between trusted and untrusted networks. The device may not need to execute obvious malware to be dangerous, it only needs to relay sessions or forward traffic in ways that preserve attacker access. NHIMG’s Ivanti Connect Secure exploitation 2024 is a concrete reminder that appliance compromise can expose credentials and related access material, which is exactly the kind of foothold that supports relay behavior.
Turning detection into a usable response
Once you suspect relay behavior, the next step is to confirm whether the edge device is a source of access abuse or only a noisy intermediary. Start by comparing authentication, network forwarding, and admin access timelines, then ask whether the appliance is seeing sessions it should never terminate or proxy. If yes, treat the device as a potential pivot point and scope other systems that authenticated through it.
For practitioners, the most useful control decision is to assume the relay can be both the compromise and the mechanism of persistence. That means preserving logs from the IdP, VPN, proxy, and edge device together, because each may show only part of the path. When you need a broader threat-hunting lens for credential theft and lateral movement patterns, NHIMG’s State of NHI & AI Agent Breach Report 2026 is helpful as a navigation point even though the immediate hunt is about relay behavior, not about the endpoint itself.
Risk and Threat Considerations
Edge relays are high-risk because they convert a perimeter device into a trust bridge. Once that happens, the attacker can blend legitimate-looking authentication with traffic forwarding, which makes the compromise harder to distinguish from ordinary remote access or administrative maintenance.
Failure mechanism: The device accepts or forwards sessions after compromise, then presents traffic patterns that appear normal inside any single tool but abnormal when identity, VPN, and proxy telemetry are compared together.
Impact: Attackers gain a durable foothold for credential abuse, session relay, and lateral movement, while defenders lose confidence in the edge device as a trustworthy control point.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1090 — Proxy | Relay behavior is a proxying pattern used to forward access and hide origin. |
| T1021 — Remote Services | Edge relays often enable remote access over VPN, proxy, or admin channels. | |
| T1078 — Valid Accounts | Relay activity commonly preserves or abuses legitimate authentication rather than malware alone. | |
| Recommendation — Hunt for proxy-style forwarding and correlate it with credential access and lateral movement signals. Inspect remote service sessions for unusual origin, timing, and privilege context. Treat successful logins from abnormal sources as a credential-abuse indicator, not proof of legitimacy. | ||
| CIS Controls v8 | CIS-12 — Network Infrastructure Management | Edge appliances and forwarding devices need tight management and monitoring. |
| Recommendation — Inventory, harden, and monitor edge devices as critical infrastructure assets. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and systems are monitored to detect anomalies, indicators of compromise, and other potentially adverse events | The answer depends on correlating anomalous edge, IdP, VPN, and proxy telemetry. |
| Recommendation — Correlate multi-source telemetry to detect anomalous relay behavior early. | ||
Practitioner Guidance
What to verify: Confirm that the suspicious device is actually acting as a relay by checking whether the same source participates in login, proxying, and forwarding events across multiple telemetry planes. A single unusual login is weak evidence; a repeated access path that lines up with relay-style traffic is much stronger.
What to prioritise: Preserve and correlate the IdP, VPN, proxy, and appliance logs before rotating assumptions about user compromise. If the device is still reachable, scope any sessions or tokens that traversed it as potentially exposed, because the relay function may have preserved access even after the initial intrusion.
Practitioner takeaway: The best detector for a compromised relay is not a signature, it is a mismatch between expected operator behavior and the device’s actual position in the access path.
Related resources from NHI Mgmt Group
- How should security teams detect compromised logins when browser telemetry is available only on managed devices?
- Why are NHIs a critical concern for security teams?
- How should teams reduce the risk of exposed AI credentials being abused?
- What steps should security teams take to prevent Shadow AI risks?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 12, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org