Attacker behavior is the set of observable actions that reveal how an intruder is operating on a network or system. Instead of focusing only on malware signatures or individual alerts, defenders look for patterns that match tactics such as reconnaissance, lateral movement, credential abuse, persistence, or command and control.
This matters because many attacks blend into normal traffic. A single event may look harmless, but a sequence of actions can expose intent: a host scanning peers, a new authentication path between machines, unusual remote administration, or periodic outbound connections to an external server. Network Detection and Response tools often score these behaviors to prioritize likely compromise and reduce noise. In defense, behavior-based detection helps analysts connect evidence across packets, identities, and endpoints, making post-compromise activity easier to spot even when the initial breach was missed.