A network trigger is a specific packet, message, or protocol sequence that causes dormant malware to activate. Instead of beacons, callbacks, or constant command-and-control traffic, the implant stays quiet until it sees the exact network condition it is programmed to recognize.
This matters because trigger-based malware is harder to spot with traffic monitoring alone. A defender may see no suspicious outbound connections until the activation packet arrives, and even then the malicious behavior may be brief or one-time. Attackers use triggers to hide payloads, delay execution, or require an operator to know a secret format. Defenders look for unusual packet patterns, hidden parsing logic, and endpoint events that follow a specific inbound message. Combining network inspection with host telemetry is often the best way to catch this kind of dormant threat.