Analyze indicators of potential malicious activity
Network, host, and application indicators — reading symptoms and naming the attack. The heaviest analysis objective on the exam.
- Reading time
- 34 min read
- Flashcards
- 20 cards
- Practice questions
- 12 questions · 3 PBQs
This is the objective the exam leans on hardest. You are shown a symptom and asked to name the disease. Not "what is beaconing" — you are given a connection every 60 seconds to the same host with near-identical byte counts, and asked what it is.
So learn indicators as symptom → diagnosis pairs, not as definitions.
Network indicators
Bandwidth consumption
An unusual volume of outbound traffic, especially to a destination the host has no business reason to contact. The classic exfiltration tell — and it survives encryption, because volume is metadata.
Beaconing
Regular, periodic connections to the same external host. Malware checking in with its command-and-control server. The tell is regularity: humans browse in bursts, implants tick like a clock.
Beaconing is worth dwelling on because it is the single most testable network indicator. Real C2 adds jitter — a random ±20% to the interval — specifically to defeat naive periodicity detection. The counter-tell is that jittered beacons are still far more regular than human traffic, and the byte counts stay suspiciously uniform.
| Symptom | Most likely diagnosis |
|---|---|
| Connections every ~60s to one host, near-identical size | C2 beaconing |
| 800 MB outbound to an unfamiliar host at 03:00 | Data exfiltration |
| Traffic on a port that does not match its usual protocol | Tunnelling or evasion |
| Sudden scanning of many internal hosts from one workstation | Lateral movement / reconnaissance |
| Long, high-entropy DNS subdomain queries | DNS tunnelling / exfiltration |
| An internal host acting as a server it has never been | Rogue device or compromised host |
Irregular peer-to-peer communication
Internal hosts talking directly to each other in ways the architecture does not call for. Workstation-to-workstation SMB is a lateral movement signature, since workstations normally talk to servers, not to each other.
Activity on unexpected ports
Two variants, and the exam tests both: a known service on a strange port (SSH on 8080 to dodge egress rules) and strange traffic on a known port (non-HTTP data over 443 because 443 is always allowed out).
Check yourself
A workstation connects to the same external IP every 58–64 seconds, transferring 400–450 bytes each time, continuously for six days. What is this?
Host indicators
Resource symptoms
- Processor spikes with no user activity — cryptomining, or encryption during ransomware
- Memory consumption from a process that should be idle
- Drive capacity vanishing — staged data awaiting exfiltration
- Unauthorised software, or a legitimate tool in an illegitimate place
Behavioural symptoms
- Malicious processes — wrong parent, wrong path, near-miss name
- Registry Run keys and scheduled tasks that nobody created
- Unauthorised changes to system files or configuration
- Data exfiltration staging: large archives in temp directories
The tellHost indicators are almost always deviations from a baseline. Without knowing normal, none of these are visible — which is why 1.1's architecture literacy comes first.
Unauthorised privilege deserves its own note. A user account suddenly holding administrative rights, or a service account interactively logging in, is privilege escalation in progress. Service accounts should never produce interactive logons; that one fact answers a surprising number of questions.
Application indicators
- Anomalous activity — an application doing something it was never built to do, like a web server spawning a shell
- Introduction of new accounts — persistence, and often the first thing an attacker does after gaining access
- Unexpected output — errors, unusual responses, or data appearing where it should not
- Unexpected outbound communication — an internal application reaching out to the internet unprompted
- Service interruption — sometimes an attack, sometimes the consequence of one
- Application logs — the record of all of the above, which is why unlogged applications are blind spots
Other indicators
Social engineering attempts
Reported phishing, pretexting calls, or unusual requests. Users are a sensor, and reported attempts are early warning — one report often means many delivered.
Obfuscated links
URL shorteners, encoded characters, homoglyph domains, and redirect chains. All exist to hide where a link actually goes.
Rogue devices on the network — unauthorised hardware, whether an attacker's device or an employee's unmanaged laptop. Both are unmanaged and unmonitored, which is the actual problem.
Check yourself
A finance workstation begins SMB connections to twelve other workstations within four minutes. Nothing else is unusual. What is the most likely explanation?
How to answer indicator questions
The exam rewards a specific reading discipline. In order:
- Identify what is abnormal, not what is present. Encrypted traffic is not an indicator; encrypted traffic to a host first seen an hour ago is.
- Ask what attacker goal that abnormality serves. Persistence, escalation, movement, collection, exfiltration. The indicator names the stage.
- Pick the answer that matches the stage, not the scariest-sounding option. Beaconing is C2, not exfiltration, even though both involve outbound traffic.