Indicators of malicious activity

This is a scenario objective: you read symptoms and name the attack. It covers malware types, physical attacks, network attacks, application attacks, cryptographic and password attacks, and the general indicators (impossible travel, lockouts, missing logs) that point to compromise.

Malware

Network and application attacks

Distributed denial-of-service (DDoS) floods a target from many sources; amplified and reflected variants abuse services like DNS that send large replies to a spoofed victim address. On-path attacks (also called man-in-the-middle) intercept traffic, often with ARP poisoning. DNS attacks redirect name lookups. Credential replay reuses captured authentication data. Wireless attacks include rogue access points and evil twins.

Application attacks include injection, buffer overflow, replay, privilege escalation, forgery (cross-site request forgery makes a logged-in browser send unwanted requests), and directory traversal (../../ in a path to reach files outside the web root).

General indicators

• Account lockouts across many accounts at once (spraying or brute force).
• Concurrent session use and impossible travel: logins from two distant countries minutes apart.
• Blocked content and resource consumption spikes.
• Resource inaccessibility, such as files suddenly renamed or encrypted.
• Out-of-cycle logging and missing logs, which can mean an attacker is covering tracks.
• Published or documented indicators: your data appears on a leak site.

Key terms

Ransomware

Malware that encrypts or locks a victim's data and demands payment for its return.

Trojan

Malware disguised as legitimate software that performs a hidden malicious function.

Worm

Self-replicating malware that spreads across networks without user action.

Virus

Malicious code that attaches to a file or program and spreads when a user runs it.

Keylogger

Malware or hardware that records keystrokes to capture passwords and other input.

Rootkit

Malware that hides deep in the operating system or firmware to keep privileged, concealed access.

Logic bomb

Malicious code that runs only when a specific condition or date occurs.

Distributed denial-of-service (DDoS)

Overwhelming a target with traffic from many sources so legitimate users can't reach it.

Amplified DDoS

A flood that uses services sending large replies to small spoofed requests aimed at the victim.

On-path attack

Intercepting and possibly altering traffic between two parties without their knowledge.

Evil twin

A rogue wireless access point that copies a legitimate network's name to lure users.

Credential replay

Capturing valid authentication data and reusing it to impersonate a user.

Directory traversal

Using path sequences such as ../ to access files outside a web application's intended folder.

Cross-site request forgery (CSRF)

Tricking a logged-in user's browser into sending an unwanted request to a site that trusts it.

Password spraying

Trying a few common passwords against many accounts to avoid lockouts.

Downgrade attack

Forcing a connection to fall back to a weaker protocol or cipher that is easier to break.

Impossible travel

Logins for one account from locations too far apart to reach in the time between them.

Missing logs

Unexpected gaps in log data that can indicate an attacker erased evidence.