On a connected network, you assume your tools work: EDR agents call home for behavioral analysis, SIEM streams to a cloud backend, vulnerability scanners pull definitions, and threat intel feeds update automatically. On an air-gapped network, none of that happens. Every tool must run locally. Every signature and definition must be brought in manually. Every log must be stored, searched, and correlated on local infrastructure. The gap is not just a network architecture decision. It is a fundamental constraint on your detection capability.

The paradox: air-gapped networks contain the most sensitive data (classified intelligence, weapons systems, critical infrastructure controls, research IP) but have the weakest detection posture because the tools that modern security depends on require the connectivity that the air gap removes.

On an air-gapped network, certain artifacts should never appear. Their presence is not just suspicious, it is a confirmed anomaly that demands investigation.

• Any internet-bound connection attempt. DNS queries to external resolvers, HTTP/HTTPS to public IPs, NTP to internet time servers. If the network is truly air-gapped, these should be impossible. Their presence indicates a misconfiguration, an unauthorized bridge, or an attacker attempting to establish connectivity.
• Unauthorized removable media. USB devices not in your approved device inventory. Personal phones connected via USB. External drives brought in without following the media sanitization process. Removable media is the #1 air-gap crossing vector (Stuxnet, Agent.BTZ).
• Software not on the approved baseline. Any executable, script, or tool not present in the system baseline image. On a controlled enclave, software installation is managed. Anything outside that process is either a policy violation or an indicator of compromise.
• Wireless signals. WiFi access points, Bluetooth devices, or any RF emission from a system that should have no wireless capability. Some air-gap bypass techniques use covert wireless channels.
• Accounts that don't belong. Local admin accounts not in the baseline, service accounts with interactive logon capability, or domain accounts that don't map to authorized personnel.

1. 1. Audit every cross-domain transfer If files move from a lower-classification network to the air-gapped environment via sneakernet, data diode, or manual process, every transfer is an attack surface. Check: what content types are allowed, is active content stripped, are files scanned with current YARA rules before introduction, and is there an integrity chain from origin to destination? The SharePoint CVE Chain demonstrated that vulnerabilities can be triggered when applications process transferred files. Transfer logs · Content inspection records · YARA scan results
2. 2. Monitor USB and removable media activity Every USB insertion should be logged and auditable. Search Sysmon EID 11 for file creation events on removable media paths. Search Security EID 6416 for new USB device connections. Cross-reference against your approved device inventory. Any unrecognized device is an immediate investigation. Sysmon EID 11 on removable paths · Security EID 6416 · USB device inventory
3. 3. Verify patch and definition integrity Patches, AV definitions, and tool updates must be delivered via secure media. Verify: are patches integrity-checked (hash verified against a trusted source) before application? Could a compromised patch delivery mechanism introduce malicious code? Is the update media itself clean? Supply chain compromise of the patch delivery process is an air-gap crossing vector. Supply Chain playbook · Hash verification · Patch source audit
4. 4. Hunt for unauthorized network bridges Scan for: hosts with multiple network interfaces (one on the air-gapped segment, one connected elsewhere), unauthorized WiFi adapters, cellular modems, or any device that bridges the air gap. Check ARP tables for unexpected MAC addresses. Run wireless scans for rogue access points. A single bridge defeats the entire air gap. Network scan: multi-homed hosts · Wireless survey · ARP table audit
5. 5. Baseline and monitor all running processes On a controlled enclave, the process inventory should be stable. Create a known-good process baseline and alert on any deviation. New processes, processes running from non-standard paths, and processes with unexpected parent-child relationships are all indicators. osquery's scheduled queries run locally and can report process inventory drift. HOST: Execution · osquery: processes table · Sysmon EID 1 baseline
6. 6. Check for data staging and exfiltration preparation On an air-gapped network, exfiltration requires physical media. Hunt for: archive creation (zip, 7z, rar, tar) on workstations or servers, large file copies to directories that align with removable media mount points, encryption of staged files (the attacker encrypts collected data before exfiltrating via USB), and files placed in locations accessible to transient devices. HOST: Impact · Sysmon EID 11 on staging paths · Data Exfil
7. 7. Audit privileged account usage On an air-gapped network with limited monitoring, insider threat and credential abuse are elevated risks. Audit: admin account logons against expected schedules, service account interactive sessions (should never happen), accounts accessing resources outside their role, and any account activity during non-operational hours. Insider Threat playbook · Security EID 4624 · Privileged account audit
8. 8. Verify security tool health On a connected network, tool health is monitored centrally. On an air-gapped network, you must check manually: are AV definitions current (within your update cycle), are Sysmon/auditd agents running on every host, is log collection functioning (check for gaps), are YARA rules current, and is the local SIEM ingesting from all sources? A tool that silently stopped running could go unnoticed for weeks. EDR/AV agent health check · SIEM ingestion audit · Log gap analysis

Classified government networks (SIPR, JWICS, allied equivalents): Windows/Linux endpoints, Active Directory, SharePoint, email, file shares. Full enterprise IT stack without internet. The SharePoint CVE Chain is particularly relevant here: SharePoint is deployed on-prem, processes uploaded files, and the exploit chain works entirely without internet connectivity.

Secure research and development: labs handling sensitive IP, pharmaceutical research, defense contractor enclaves. Often have controlled data diode transfers from external networks. The cross-domain transfer process is the primary attack surface.

OT/ICS networks: Industrial environments that are air-gapped (or should be). These have the additional complexity of ICS protocols, PLCs, and physical process integrity. See the dedicated ICS / SCADA / OT playbook for OT-specific hunting.

ICS / SCADA / OT (OT-specific detection in industrial environments)
SharePoint CVE Chain (fully functional inside air-gapped SharePoint farms)
Insider Threat (elevated risk in environments with limited monitoring)
Supply Chain Indicator (patch delivery and media transfers as attack vectors)