Given a scenario, analyze indicators of malicious activity
Recognize malware, network, application, and physical attacks from their observable indicators. Heavy PBQ territory.
- Reading time
- 34 min read
- Flashcards
- 24 cards
- Practice questions
- 12 questions · 3 PBQs
The largest objective in Domain 2 and the one most likely to appear as a performance-based question. "Given a scenario" means you will be shown symptoms and asked what is happening.
The skill is symptom → attack. Learn the distinguishing indicator for each, not just the definition.
Malware
Virus
- Attaches to a file
- Needs a user to run it
Worm
- Self-replicating across a network
- Needs NO user action
Trojan
- Disguised as something legitimate
- The user installs it willingly
The tellSpreading by itself across the network with nobody clicking anything is a worm. That autonomy is the identifier.
Ransomware
Encrypts data and demands payment. Primarily an availability attack (see 1.2). Modern variants exfiltrate first — double extortion — which adds a confidentiality loss.
Spyware
Covertly gathers information about the user.
Keylogger
Records keystrokes. The specific indicator is credential theft with no phishing and no breach of the credential store.
Rootkit
Hides its own presence, often at kernel level. The indicator: tools disagree with each other, or the system behaves in ways the logs do not explain.
Logic bomb
Dormant code that triggers on a condition — a date, or an account being removed from payroll. Classic insider technique.
Bloatware
Unnecessary preinstalled software. Not malicious, but it enlarges the attack surface.
Check yourself
Malware spreads across an entire network segment overnight with no user interaction of any kind. Which type?
Physical attacks
Brute force (physical) — forcing entry. RFID cloning — copying an access badge. Environmental — attacking power, cooling or fire suppression to cause an outage.
Network attacks
DDoS
Distributed denial of service. Amplified attacks abuse a protocol that returns more than it receives (DNS, NTP); reflected attacks spoof the victim's address so responses go to them.
DNS attacks
Poisoning a cache with false records, or hijacking a domain's registration.
Wireless
Rogue access points, evil twin (an AP impersonating a legitimate one), deauthentication attacks.
On-path (MITM)
The attacker sits between two parties, relaying and possibly altering traffic. Formerly "man-in-the-middle".
Credential replay
Capturing an authentication token or hash and reusing it, without ever knowing the password.
Malicious code
Scripts and code executing where they should not.
Application attacks
Injection
SQL, LDAP, command, XML — untrusted input interpreted as instructions. See 2.3.
Buffer overflow
Writing past a buffer's bounds. See 2.3.
Replay
Capturing a valid request and resending it. Defeated by nonces, timestamps and session tokens.
Privilege escalation
Vertical — gaining higher rights than your own. Horizontal — accessing another user's data at the same level.
Forgery
Cross-site request forgery (CSRF) tricks a logged-in user's browser into making an unwanted authenticated request.
Directory traversal
Using ../ sequences to escape the intended directory and read arbitrary files.
Cryptographic attacks
Downgrade — forcing a weaker protocol version, then attacking that. Collision — two inputs producing the same hash. Why MD5 and SHA-1 are dead (1.4). Birthday attack — the probability result that makes collisions far easier to find than intuition suggests.
Password attacks
Brute force
- Tries every combination
- Many failures on ONE account
Password spraying
- One common password against MANY accounts
- Few failures per account — evades lockout
The tellCount the failures per account. Many on one account is brute force. One or two across hundreds of accounts is spraying, and lockout policies will not catch it.
Dictionary attack uses a wordlist. Credential stuffing replays username/password pairs breached elsewhere, which is why reuse is so dangerous (4.6).
Check yourself
Logs show two failed logins each against 400 different accounts within five minutes, from one source. What attack is this?
Indicators of compromise
The signals that tell you something happened. Worth learning as a checklist:
- Account lockout and concurrent session usage — the same account in two places at once
- Blocked content and impossible travel — logins from distant locations too close in time
- Resource consumption and resource inaccessibility
- Out-of-cycle logging — activity at times the user never works
- Published or documented — your data appearing publicly
- Missing logs — an attacker covering tracks (see 4.9: centralised aggregation defeats this)