Security+ SY0-801 Indicators of Malicious Activity

An indicator of malicious activity is an observable piece of evidence (a log line, a file, a process, a network pattern or a physical sign) that points to a specific kind of attack. Security+ objective 2.5 is a given a scenario objective: you are shown the evidence and must name the attack or indicator it reveals. The official list groups the attacks into six families, malware, physical, network, social engineering, application and credential attacks, and adds a seventh list of indicators of compromise (IoCs) that analysts search for after the fact.

Many attack names overlap in everyday speech, so the skill is to find the one detail that separates near twins. A worm and a virus both infect many machines; only one needs a user. Password spraying and brute force both produce failed logins; only one locks accounts. DNS cache poisoning and domain hijacking both send users to the wrong address; they differ in which server gives the bad answer.

A reliable method for any scenario: (1) note who or what acted (a user, a server, a program, a person on site), (2) note what changed or was observed, (3) pick the attack whose defining trait matches that detail, and (4) check that the trait of each tempting alternative is missing from the evidence.

These five malware types are told apart by how they get running and what triggers them. A worm spreads by itself across the network by exploiting a vulnerable service, with no user action, so its indicator is many unpatched hosts infected within minutes and a spike in scanning traffic. A virus attaches to a host file (a program, a boot sector or a document macro) and runs only when a user opens or runs that host; a macro virus infects documents and spreads to other documents. A trojan is malware disguised as, or bundled with, software the user wants, such as a game mod, a codec pack or a cracked app that genuinely does what it promises. The useful feature is the disguise; the hidden payload is the point. A remote access trojan (RAT) adds a persistent connection back to the attacker, who can then control the machine, browse its files or switch on its camera.

Ransomware encrypts or locks data and demands payment. Its indicators are loud and arrive together: a burst of disk activity, thousands of files renamed with a new extension, a ransom note dropped in every folder, and deletion of recovery points (for example vssadmin delete shadows removing Windows Volume Shadow Copies) so the victim cannot simply roll back. Many groups also steal data first and threaten to publish it. A logic bomb is code that lies dormant until a condition is met: a date and time, or an event such as a value changing in a database or a particular account no longer existing. It is often planted by an insider with legitimate access who ties the trigger to their own departure, so the damage happens after they have left. The giveaway is the conditional check in the code, script or scheduled job, not the damage itself.

These types are identified by what they collect or how they stay out of sight. Spyware secretly gathers information about the user, such as browsing history, screenshots, files or location, and sends it to a third party; a phone app that quietly sends the user's contacts and location to an unknown server is spyware. Adware exists to show or redirect advertising: sudden pop-ups, injected ads and a changed home page or default search engine after installing free software. Keyloggers record keystrokes to capture passwords and messages. They can be software, or hardware: a physical device placed in the path between keyboard and computer (an inline plug, or a tampered keyboard). A hardware keylogger runs no code on the computer, so antivirus and EDR scans usually cannot find it; a physical inspection is the reliable check, although device-control tools may flag one that shows up as an extra USB device. The pattern to recognise is several people's credentials being stolen after they typed them on the same machine that strangers can physically reach, such as a kiosk or a hotel business-centre terminal.

A rootkit modifies the operating system, often by installing a kernel driver, so that the OS's own tools (Task Manager, netstat, directory listings) no longer show the attacker's processes, files or connections. The key indicator is a cross-view discrepancy: evidence gathered from outside the running OS disagrees with what the OS itself reports. Network flow records or a switch capture show connections the host's own tools do not list, a memory image analysed on another machine shows a hidden process, or an offline scan of the disk finds files the live system will not display. An unexpected or unsigned kernel-level component (a driver or kernel module) is a further sign. Rootkits are removed by rebuilding the system, not by trusting the infected OS to clean itself.

Fileless malware runs in memory using tools already on the system (PowerShell, WMI, scripting engines) instead of dropping an executable. Typical evidence is an Office application spawning PowerShell with an encoded command, no new executable on disk, and persistence stored outside a normal file, such as a registry Run key or a WMI event subscription (held in the WMI repository, not the registry), that re-downloads and runs the script at each logon or on a system event. Because there is no file to hash, it is caught by behaviour and command-line logging rather than signature scanning.

Physical attacks are recognised by evidence in the physical world and in access-control records. Tailgating is following an authorised person through a controlled door without presenting your own credential (piggybacking is the variant where the authorised person knowingly lets them in). Because the door opened normally for someone else, nothing is damaged; the indicator is a mismatch in the records. Access logs place a person somewhere they have no entry record for (their badge is read at an internal door, lift or exit inside a zone it was never read into), or CCTV shows two people passing on a single badge read.

Shoulder surfing is watching someone enter a password, PIN or other secret, in person or through a camera. It leaves almost no technical trace; the indicator is the right secret being used by someone else with no guessing beforehand (no failed attempts), after the victim entered it where others could see, such as a crowded train, a café or an ATM queue. That contrasts with password guessing, which leaves failures, and with a keylogger, which needs a device. Skimming captures payment-card data with a device fitted over or inside a card reader (a loose overlay on a card slot, a hidden camera for the PIN), and shows up as many cards cloned after use at one terminal. Forced entry is breaking in, and leaves physical damage: pry marks, a damaged lock or hinge, broken glass. The access-control system typically logs it as a door forced open alarm, meaning the door sensor registered an opening without any valid credential being presented.

Two near twins catch people out. Tailgating involves no damage and a door that opened normally, while forced entry leaves physical damage and a door-open event without any credential. Shoulder surfing steals a secret by watching, while a hardware keylogger steals it with a device. When someone gains entry by pretending to be a technician or delivery person, that is impersonation, covered with social engineering below.

Network attacks are identified by how traffic is flooded, intercepted, weakened or redirected. A distributed denial of service (DDoS) attack exhausts bandwidth, connection tables or application resources using many sources at once. In a reflected (or amplified) DDoS, the attacker sends small requests with the victim's spoofed source address to third-party services such as open DNS resolvers, which send much larger responses to the victim; the indicator is a flood of large replies (DNS, NTP, memcached or similar) to requests the victim never made, arriving from many legitimate third-party servers. The victim's internet link saturates, while the victim's own servers show normal CPU and memory, because the traffic is choking the pipe rather than overloading the hosts.

An on-path attack (formerly man-in-the-middle) places the attacker between two parties so they can read or change traffic, typically after ARP spoofing, a rogue access point or a rogue DHCP server. A protocol downgrade is an on-path technique that forces a connection onto a weaker protocol or cipher: SSL stripping keeps the victim on plain HTTP by intercepting the redirect to HTTPS, which works when the site does not send an HTTP Strict Transport Security (HSTS) header, or on a first visit before the browser has received that header, unless the domain is on the browser's HSTS preload list; TLS downgrades push both ends to an obsolete version. Indicators are HTTP where HTTPS is expected, missing padlocks and credentials appearing in cleartext.

Sniffing is passive capture of traffic (a network tap, a mirrored port, a wireless adapter in monitor mode). It changes nothing, so it is hard to detect directly and is the reason cleartext protocols are dangerous. A rogue device is any unauthorised device on the network: a rogue access point, an evil twin broadcasting the corporate SSID to lure users, or a rogue DHCP server handing out attacker-controlled settings. Indicators are a BSSID (hardware address) missing from the inventory, certificate warnings for internal sites, or clients receiving unexpected gateway or DNS settings.

Spoofing is falsifying an identifier (an IP address, MAC address, email sender, caller ID or DNS answer) so that traffic or trust goes to the attacker. When users end up at the wrong destination, the way to name the attack is to find where the bad mapping comes from.

• DNS cache poisoning: a recursive resolver has stored a forged record, so everyone using that resolver gets the attacker's address (often with a long TTL so it persists), while the domain's authoritative name server still returns the correct answer.
• Domain hijacking: the attacker takes control of the domain's registration or authoritative DNS records, so the authoritative answer itself is wrong for everyone on the internet.
• Local DNS tampering: an edited hosts file or changed DNS server setting affects only that machine.
• ARP spoofing (ARP poisoning): on the local segment, the attacker answers ARP for the gateway's IP address with its own MAC address, so a client's ARP table shows the correct gateway IP mapped to the wrong MAC.
• Rogue DHCP: an unauthorised DHCP server gives clients a different default gateway or DNS server IP; the IP-to-MAC mappings stay accurate (the change is in the IP settings themselves), and hosts with statically configured addresses are unaffected because they never ask DHCP.
• DNS tunneling: data is smuggled out (or commands smuggled in) inside DNS queries and responses. Indicators are many queries to one unfamiliar domain with long, random-looking subdomains, and unusually high volumes of TXT or NULL record lookups.

Social engineering attacks are named by who is targeted, how tailored the lure is and which channel carries it. Phishing is a fraudulent message sent broadly, hoping some recipients click or reply. Spear phishing targets a specific person or small group with researched details, such as a real invoice number, the name of a usual supplier contact or an ongoing project. Whaling is spear phishing aimed at a senior executive (a CEO, CFO or board member), typically about high-value actions like wire transfers, acquisitions or legal matters. The deciding question is the target's seniority, not how convincing the lure is: a carefully researched message sent to staff who are not executives is still spear phishing.

The channel variants keep the same idea on a different medium: smishing uses SMS or chat messages, vishing uses voice calls (often with spoofed caller ID showing an internal or bank number), and quishing uses QR codes, for example a counterfeit code printed on a poster, a restaurant table card or a fake delivery notice, or a QR code in an email that moves the victim onto a phone outside corporate filtering. When an attack mixes channels, name it by the channel where the manipulation and the request actually happen; a message that only sets up a later conversation does not make the conversation smishing.

Impersonation is pretending to be someone with a legitimate reason for access, such as an ISP technician, an auditor or a help-desk agent, usually with a supporting pretext (a named manager, a uniform, a work order). A deepfake is AI-generated or AI-altered audio or video that imitates a real, trusted person; the indicators are a familiar face or voice making an unusual, urgent request (often for money or credentials) over a channel where it cannot easily be checked, signs of synthesis such as odd lip sync or flat intonation, and the real person later confirming they never made the request. Defences focus on verification out of band: call back on a known number, and require a second approver for payments.

Application attacks are recognised by what the malicious input looks like and what the application does with it, usually visible in web server, WAF or IDS logs.

• Injection sends input that the application passes to an interpreter as code. SQL injection shows quote characters and SQL syntax in input fields (admin'--, ' OR '1'='1, UNION SELECT); command injection shows shell separators such as ;, | or &&; LDAP injection shows filter syntax such as *)(. Parameterised queries and input validation prevent it.
• Buffer overflow writes more data than a memory buffer holds, overwriting adjacent memory. Indicators are input far longer than the field should ever hold, a NOP sled (repeated x86 no-operation instructions, byte value 0x90) leading into a payload of shellcode, and the target process faulting or restarting.
• Directory traversal uses ../ sequences, often URL-encoded (..%2f, %2e%2e%2f) or double-encoded, in a file parameter to read files outside the web root, such as /etc/passwd.
• Forgery makes a trusted party send a request the attacker chose. In cross-site request forgery (CSRF) the victim's browser sends a state-changing request to a site where the victim is logged in, carrying the valid session cookie, triggered by a hidden form or image on another site (a foreign Referer is a clue). In server-side request forgery (SSRF) the server is tricked into fetching a URL, often an internal one such as a cloud instance metadata address (169.254.169.254) to steal credentials.
• Replay captures valid authentication material (a session token, a Kerberos ticket, an NTLM password hash) and reuses it to authenticate without knowing the password. Against a captured network exchange or token, nonces, timestamps and short-lived tokens defend against replay. Pass-the-hash is the common Windows form and works differently: NTLM authentication already uses a server challenge, but the password hash is itself the secret used to answer any challenge, so a hash dumped from memory lets the attacker log on to other servers without ever cracking it. It shows up as successful logons with a privileged account on systems where that person never typed a password. Pass-the-hash is countered by credential protections (Credential Guard, unique local administrator passwords, restricting where privileged accounts log on, disabling NTLM), not by nonces.
• Privilege escalation gains rights beyond those granted. Vertical escalation goes up (a standard user becomes an administrator or SYSTEM, often by abusing weak permissions on something a privileged account runs, such as a service binary, scheduled-task script or startup file that ordinary users can modify, or by exploiting a vulnerable driver or SUID program); horizontal escalation reaches another user's data at the same level. The indicator is an account appearing in a privileged group, or doing things its role cannot.

Credential attacks are told apart by the pattern of attempts across accounts and passwords in authentication logs. Brute force tries many passwords against one account (or a few), so it produces many failures per account and usually trips account lockout. Password spraying tries a few very common passwords (predictable patterns such as the company name plus digits) against many accounts, pausing between rounds to stay under the lockout threshold, often from rotating IP addresses; the indicator is one or two failures on each of hundreds of accounts and no lockouts. Offline brute force against stolen hashes leaves no login failures at all.

User enumeration discovers which usernames exist by observing different responses, such as "Unknown user" versus "Incorrect password", different error codes or different response times. Attackers often enumerate first and then spray only the valid accounts. Returning the same generic message and timing for both cases removes the signal.

MFA bypass covers ways around a second factor:

• MFA fatigue (push bombing): with a stolen password, the attacker triggers repeated push approval requests, often at night, until the user taps Approve. Number matching and limits on prompts counter it.
• Adversary-in-the-middle session-token theft: a phishing site relays the real sign-in page, the user enters password and MFA code, and the proxy captures the resulting session cookie. The attacker replays that cookie, so the identity provider shows activity from a new IP address or device that never went through an MFA challenge of its own, while the real user's session carries on undisturbed. Phishing-resistant MFA (FIDO2 / passkeys) defeats it.
• SIM swapping: the attacker persuades a mobile carrier to move the victim's number to a new SIM and receives SMS codes; the victim's phone suddenly loses service.

Indicators of compromise (IoCs) are artifacts that show a system or account has already been compromised, used to hunt for the same attacker elsewhere. They fall into three groups.

Atomic indicators

A hash (for example SHA-256) identifies an exact file whatever it is named, so it finds every copy of a known sample, but changes completely if one byte changes. An IP address and a domain identify attacker infrastructure, but attackers rotate cloud IPs cheaply and can generate new domains automatically with a domain generation algorithm (DGA). Plaintext strings inside malware or its traffic (a hard-coded User-Agent, mutex name, file path or command) are part of the tool's design and often survive recompilation, so they stay useful longer. The Pyramid of Pain model captures this: indicators that are cheap for the attacker to change (hashes, IPs) are cheap to evade; tool and behaviour traits cost them more.

Host indicators

• Malicious processes: judge a process by its path, parent and behaviour, not just its name. Core Windows processes have fixed parents and locations: svchost.exe is started by services.exe, services.exe and lsass.exe by wininit.exe, and explorer.exe by userinit.exe, all from C:\Windows\System32 (explorer from C:\Windows). A process with a trusted system name but an unexpected parent, a path outside those folders (for example lsass.exe running from a user's Temp folder) or a near-miss spelling is a strong indicator of masquerading.
• File-system artifacts: dropped tools, unexpected scripts, renamed files, ransom notes, new scheduled tasks or services.
• Timestamp tampering (timestomping) changes a file's dates to blend in. On NTFS, user-mode tools easily alter the $STANDARD_INFORMATION times shown in Explorer, but the $FILE_NAME times are much harder to change, so a mismatch between the two sets of times (especially $STANDARD_INFORMATION dates earlier than $FILE_NAME dates) is a red flag.
• Log manipulation: cleared logs, gaps in sequence or time, or disabled auditing. In Windows, Security log event 1102 records that the audit log was cleared (System log event 104 records other logs being cleared), while event 1104 only records that the Security log is full.

Behavioural and account indicators

• Excessive resource consumption: unexplained CPU, memory, disk or bandwidth use, such as outbound volume far above a host's baseline to a destination the organisation does not use (possible exfiltration), constant CPU load (cryptomining) or heavy disk I/O (ransomware). Because it shows up in flow records and performance monitoring, it is often the first indicator noticed, without anyone logging on to the endpoint.
• Account lockout: a user repeatedly locked out by failed sign-ins they did not make indicates password guessing against that account (or a deliberate denial of service).
• Impossible travel: sign-ins from locations too far apart to cover in the time between them. It compares distance with elapsed time, so the sessions do not have to overlap.
• Concurrent sessions: the same account active in two sessions at the same time where that should not happen. It is about overlap in time, so distance does not matter.