- How indicators of malicious activity help analysts recognize suspicious behavior.
- How to distinguish ransomware, Trojans, worms, spyware, viruses, keyloggers, logic bombs, rootkits, and bloatware.
- How physical, network, application, cryptographic, and password attacks appear in scenarios.
- How amplified or reflected DDoS, DNS, wireless, on-path, and credential-replay attacks differ.
- How to separate password spraying from brute-force attempts.
- How account lockouts, impossible travel, concurrent sessions, blocked content, resource consumption, unusual logging, and missing logs can indicate malicious activity.
- How to correlate evidence instead of treating a single anomaly as conclusive proof of compromise.
Official objective 2.4 asks candidates to analyze indicators of malicious activity. This lesson covers malware, physical, network, application, cryptographic, and password attacks, alongside the behavioral and logging indicators that may reveal them.
What Are Indicators of Malicious Activity?
An indicator of malicious activity is an observable event, behavior, artifact, or pattern that may suggest an attack or unauthorized action. Indicators can appear in endpoint alerts, authentication records, DNS queries, firewall logs, application errors, system performance, physical-access records, or user reports.
An indicator does not always prove an attack on its own. A legitimate employee can travel, a server can experience a traffic spike, and an application can crash because of a software defect. Analysts evaluate the context, compare related evidence, and investigate alternative explanations.
Indicator: observable evidence that may point to suspicious activity.
Indicator of compromise (IOC): evidence or an artifact associated with a potential or known compromise, such as a malicious file hash, suspicious domain, or unauthorized persistence mechanism.
Indicator of attack (IOA): evidence of behavior suggesting an attack is occurring or being attempted, such as repeated password guesses or suspicious privilege changes.
In exam scenarios, focus on the combination of clues: what happened, which account or system was involved, when it occurred, what changed, and whether the behavior matches expected business activity.
A Practical Indicator-Analysis Process
A useful approach is to observe the alert, preserve relevant evidence, correlate related events, classify the likely attack, and follow the organization’s incident-handling procedures.
Identify the event, alert, report, or behavior that looks unusual.
Record relevant timestamps, accounts, source and destination details, host identifiers, and logs.
Compare identity, endpoint, network, DNS, application, and physical-access evidence.
Identify the most likely attack family, consider alternatives, and follow incident-response procedures.
1. Malware Attacks and Their Indicators
Malware is software or code intended to perform malicious actions. Different categories are identified by their behavior, delivery, persistence, propagation, and impact. A single malicious program may combine several characteristics, so classify it using the strongest clue in the scenario.
| Malware type | Core behavior | Possible indicator |
|---|---|---|
| Ransomware | Encrypts or otherwise blocks access to data or systems and demands payment; some incidents also involve data theft. | Files rapidly renamed or encrypted, unusual extensions, ransom notes, inaccessible data, or unexpected encryption activity. |
| Trojan | Appears legitimate or useful while concealing malicious functionality. | A seemingly genuine program creates an unexpected connection, launches an unexplained process, or installs additional components. |
| Worm | Self-propagates across systems or networks, often by exploiting vulnerabilities or weak configuration. | Rapid spread between hosts, repeated network scanning, or similar infections appearing without each user manually running a new copy. |
| Spyware | Secretly collects user activity, information, or other data. | Unexpected monitoring, unexplained outbound traffic, unauthorized data collection, or suspicious changes to privacy settings. |
| Bloatware | Unwanted or unnecessary software consumes resources or expands the attack surface; not all bloatware is malicious. | Unneeded bundled applications, unexpected resource use, unwanted services, or additional software that users cannot easily explain. |
| Virus | Attaches to a host file or program and propagates when infected content is executed or shared. | Modified host files, infected executables, repeated detections, or infection following execution of a contaminated file. |
| Keylogger | Records keystrokes or related input to capture sensitive information. | Suspicious input-capture behavior, an unknown background process, or credential theft linked to a compromised endpoint. |
| Logic bomb | Malicious code triggers when a specific condition or time is reached. | Destructive or unauthorized actions occur at a planned time or after a particular event, account, or condition. |
| Rootkit | Conceals malicious activity or helps maintain privileged, stealthy access. | Disagreement between trusted system tools and lower-level telemetry, concealed processes, unexpected privileged changes, or persistent hidden components. |
Worm: spreads autonomously. Virus: attaches to a host and propagates through execution or sharing. Trojan: disguises malicious functionality as legitimate software. Ransomware: prevents access to files or systems and demands payment.
Malware indicators in a scenario
Files and Access
- Unexpected mass file changes or encryption.
- New ransom notes or strange file extensions.
- Users suddenly cannot open business documents.
- Unexpected deletion or modification of backups.
Processes and Persistence
- Unknown processes or services.
- Unexpected changes to startup settings.
- Suspicious outbound connections.
- Endpoint security tools unexpectedly disabled.
2. Physical Attacks
Physical attacks target facilities, people, devices, access mechanisms, or environmental dependencies. They can be used to gain entry, disrupt services, steal equipment, or bypass controls that protect sensitive systems.
| Attack type | What it involves | Possible indicator |
|---|---|---|
| Physical brute force | Repeated attempts to force entry, defeat a physical lock, or overcome a physical access barrier. | Repeated access attempts, damaged locks, forced doors, tampering, or repeated denied badge events. |
| RFID cloning | Copying or emulating radio-frequency identification credentials to impersonate a credential holder. | Duplicate or impossible access patterns, unexplained badge use, or entry records inconsistent with a person’s location. |
| Environmental attack or disruption | Exploiting or causing environmental conditions such as overheating, flooding, fire, or loss of power to disrupt systems. | Temperature alarms, water sensors, smoke alarms, power irregularities, or unexpected equipment shutdowns. |
An environmental alert is not automatically malicious; it may be an accident or equipment failure. Analysts must compare sensor records, physical-access logs, maintenance activity, and the actual system impact before concluding that an attack occurred.
3. Network Attacks
Network attacks target communication paths, protocols, services, or networked systems. Indicators may include unusual traffic volume, unexpected DNS responses, suspicious wireless behavior, unexpected authentication exchanges, or network communications that do not match normal patterns.
Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS)
A denial-of-service attack attempts to make a system or service unavailable. A DDoS attack uses multiple sources or systems to overwhelm a target or exhaust a resource. Indicators can include sudden traffic increases, high connection rates, resource saturation, elevated latency, and legitimate users being unable to reach a service.
Amplified DDoS
An attacker causes responding systems to send replies larger than the triggering requests, increasing traffic directed toward the victim.
Clue: the victim receives disproportionately large volumes of responses compared with the initiating requests.
Reflected DDoS
An attacker sends requests to intermediary systems using a spoofed source address, causing replies to be directed to the victim.
Clue: traffic arrives from legitimate-looking third-party responders that were induced to reply to the target.
DNS attacks
Domain Name System attacks abuse or manipulate the process that translates domain names into network addresses. Possible techniques include spoofed replies, poisoning name-resolution data, or interfering with DNS availability.
- Unexpected name resolution: a familiar domain resolves to an unexplained or unauthorized address.
- DNS poisoning or spoofing indicators: inconsistent DNS answers, unexpected resolver records, or suspicious redirection.
- DNS service disruption: repeated timeouts, resolution failures, or abnormal query patterns affecting legitimate users.
Wireless attacks
Wireless attacks can target Wi-Fi networks, wireless clients, authentication exchanges, or radio communication. Examples include deceptive access points, unauthorized wireless devices, and attempts to capture or interfere with network traffic.
Possible indicators: an unfamiliar access point using a trusted-looking name, a device associating with an unexpected network, repeated wireless authentication failures, or suspicious changes to wireless configuration.
On-path attacks
An on-path attack occurs when an attacker positions themselves between communicating parties and intercepts or manipulates traffic. Older resources may use the term man-in-the-middle for similar concepts.
Possible indicators: unexpected certificate warnings, unusual certificate or protocol changes, suspicious gateway or name-resolution changes, or evidence that traffic is passing through an unapproved intermediary. A certificate warning can also arise from an expired certificate or configuration error, so validate the evidence.
Credential replay
A credential replay attack reuses captured authentication material or previously observed authentication data to attempt access. It differs from guessing a password because the attacker may be replaying material obtained from an earlier exchange.
Possible indicators: authentication attempts associated with a previously captured session or token, repeated use of an unexpected authentication artifact, or an access pattern inconsistent with the legitimate user’s session.
Malicious code and suspicious network behavior
Malicious code may use a network connection to receive instructions, send stolen data, discover other hosts, or spread. Analysts may find unusual outbound destinations, repeated connections at fixed intervals, unexpected lateral traffic, or network communication from software that should not need it.
4. Application Attacks
| Attack type | Core idea | Possible indicator |
|---|---|---|
| Injection | Untrusted input is interpreted as part of a command, query, or expression. | Unexpected query behavior, unusual application errors, suspicious input patterns, or unauthorized data access. |
| Buffer overflow | Software writes beyond an allocated buffer or memory boundary. | Crashes, memory corruption, unusual process termination, or suspicious behavior around malformed input. |
| Replay | Previously captured data or a valid transaction is resent to repeat or impersonate an earlier action. | Duplicate or stale transactions, repeated requests that should be unique, or reused authentication material. |
| Privilege escalation | An actor gains permissions beyond those legitimately assigned. | Unexpected administrator activity, changes to privileged groups, or access to restricted functions. |
| Forgery | A message, identity artifact, record, request, or other data is falsified to appear genuine. | Inconsistent sender or transaction details, forged requests, altered records, or conflicting audit evidence. |
| Directory traversal | Input manipulates file paths so an application accesses resources outside its intended directory boundary. | Suspicious path sequences, requests for restricted files, or repeated attempts to escape an application’s directory. |
Injection involves untrusted input affecting a command or query. Directory traversal focuses on unauthorized file-path access. Privilege escalation changes the actor’s effective permissions. Replay reuses previously captured data or a transaction.
5. Cryptographic Attacks
Downgrade attacks
A downgrade attack attempts to force communicating systems to use a weaker protocol version, cipher, or security option than they could otherwise use. This can reduce protection and may expose weaknesses in the negotiated configuration.
Possible indicators: unexpected fallback to an obsolete protocol or cipher, protocol-negotiation anomalies, or evidence that systems accepted settings that policy should disallow.
Collision attacks and birthday-related weaknesses
A hash collision occurs when two different inputs produce the same hash value. Collision resistance is an important property of a cryptographic hash function. A collision attack attempts to find or exploit this property in a way that undermines the intended security use.
The birthday effect explains why collisions can become statistically likely sooner than a simple linear search intuition suggests. A birthday-related attack exploits this property against an unsuitable or insufficiently strong hash construction.
Possible indicators: known weaknesses in a selected hash algorithm, use of an obsolete algorithm where collision resistance is required, or evidence that an attacker is trying to substitute data while relying on a weak integrity check.
A downgrade attack targets the negotiated security level. A collision attack targets the uniqueness properties expected from a hash. The scenario’s evidence determines which is the better answer.
6. Password Attacks
Brute-force attacks
A brute-force attack systematically tries many possible passwords or credential combinations against an account or other authentication target. The attempt may use a large number of guesses against one account or a group of accounts, depending on the method.
Possible indicators: repeated failed authentication attempts, elevated login failure counts, account lockouts, and attempts that continue across different time intervals.
Password spraying
Password spraying attempts a small set of commonly used or otherwise selected passwords against many accounts, often trying to avoid triggering controls that detect many failures against one account.
Possible indicators: a similar password attempt against multiple users, low numbers of failures per user but a broad set of targeted accounts, or authentication failures distributed across the environment.
Brute force vs. password spraying
| Clue | Brute force | Password spraying |
|---|---|---|
| Typical pattern | Many guesses against a target or set of targets. | A small number of password guesses distributed across many accounts. |
| Account failures | May quickly generate many failures for a specific account. | May keep failures per account relatively low to evade simple lockout thresholds. |
| Log clue | Repeated guesses concentrated on a user or authentication endpoint. | Similar attempts across multiple user accounts or a broad identity population. |
| Investigation focus | Failure rate, source, account, and authentication patterns. | Shared timing, source, password-attempt pattern, and affected accounts. |
7. Common Indicators of Malicious Activity
| Indicator | Meaning | What to investigate |
|---|---|---|
| Account lockout | An account is locked after failed authentication attempts or according to a configured policy. | Failure patterns, source addresses, targeted accounts, and whether a legitimate user forgot a password. |
| Concurrent session usage | The same account has sessions active at the same time in circumstances that may be unusual. | Device, IP, location, session token, normal user behavior, and possible session theft. Concurrent sessions can also be legitimate. |
| Blocked content | Security controls block a site, file, application, or request under policy. | Repeated blocks, source identity, destination, policy category, and whether the user or a process repeatedly retries. |
| Impossible travel | Two sign-ins appear to originate from locations too far apart for the elapsed time. | Sign-in timestamps, VPN or proxy use, geolocation accuracy, session tokens, and device identity. |
| Resource consumption | CPU, memory, disk, bandwidth, or another resource is consumed unusually. | Process activity, traffic rate, scheduled jobs, capacity events, cryptomining indicators, or denial-of-service symptoms. |
| Resource inaccessibility | Users cannot reach files, services, accounts, or other resources they normally need. | Service health, access changes, encryption activity, network status, and recent administrative actions. |
| Out-of-cycle logging | Events or logging behavior occurs outside expected business or system schedules. | Unexpected service starts, off-hours administrative activity, unusual log volume, and recent configuration changes. |
| Published or documented indicators | A known indicator, exploit, or malicious artifact has been publicly documented by a trusted source. | Whether the organization uses the affected product or indicator, whether local evidence matches, and whether the information is current. |
| Missing logs | Expected logs are absent, unexpectedly stopped, deleted, or no longer being forwarded. | Collector health, storage capacity, configuration changes, system time, permissions, and possible attempts to hide activity. |
Impossible travel can result from VPNs or inaccurate geolocation. Concurrent sessions can be normal. Resource spikes can come from legitimate workloads. Missing logs may result from a failed collector. The exam usually provides additional clues to help you identify the most likely explanation.
8. Evidence-to-Attack-Family Reference
9. Common Security+ Exam Traps
- Worm vs. virus: a worm spreads autonomously; a virus attaches to a host file or program.
- Brute force vs. spraying: look at how attempts are distributed across accounts.
- Amplified vs. reflected DDoS: amplification increases response volume; reflection directs third-party responses to a victim, and one attack may use both.
- On-path vs. credential replay: on-path describes the attacker’s position in communication; replay describes reuse of captured data or authentication material.
- Injection vs. directory traversal: injection affects command or query interpretation; traversal targets file-path boundaries.
- Downgrade vs. collision: downgrade weakens protocol negotiation; collision attacks target hash properties.
- Impossible travel is an alert, not a verdict. Validate VPNs, proxies, device evidence, time, and session details.
- Missing logs deserve investigation. A logging outage and intentional log tampering may look similar at first.
10. Quick Reference
| Scenario clue | Likely category |
|---|---|
| Files suddenly encrypted or inaccessible with a ransom note | Ransomware |
| Malicious program disguised as legitimate software | Trojan |
| Rapid infection spreading between hosts | Worm |
| Secret monitoring of keystrokes or user activity | Keylogger or spyware |
| Many failed logins against one or more accounts | Brute force or password spraying, depending on pattern |
| High traffic and legitimate users cannot access a service | DoS or DDoS |
| Domain resolves to an unexpected or malicious address | DNS attack or misconfiguration, depending on evidence |
| Attacker intercepts traffic between communicating parties | On-path attack |
| Untrusted input changes database-query behavior | Injection attack |
| Unexpected elevated permissions | Privilege escalation |
| Protocol or cipher unexpectedly falls back to a weaker option | Downgrade attack |
| Two different inputs are shown to produce the same hash | Hash collision |
| Unexpected account lockouts, concurrent sessions, or impossible travel | Potential identity compromise; correlate additional evidence |
| Expected logging suddenly stops or contains unexplained gaps | Logging failure or possible defense evasion |
Identify the observed clue, decide which attack family best explains it, and validate the conclusion with related evidence. The strongest answer is the one supported by the scenario—not simply the most severe-sounding option.
Practice Questions
10 scenario-based questions. Expand each question to reveal the answer and explanation.
Exam Quiz
Lesson 02.5 — Indicators of Malicious Activity · 15 questions · 10 minutes
Malicious Activity — Exam Simulation
Analyze malware, physical, network, application, cryptographic, and password attack indicators along with suspicious account and system behavior.
15 Questions
Lesson 02.5 scope
10 Minutes
Timed attempt
Instant Feedback
Explanation after each answer
Answer Review
Score and explanations
Lesson 02.5 — Summary
Indicators of Malicious Activity: Recognizing Attack Evidence
Domain 2.0 — Threats, Vulnerabilities and Mitigations · 22% of Security+ SY0-701
📌 Key Takeaways from Lesson 02.5
Ransomware blocks data access; worms self-propagate; Trojans disguise malicious functionality.
DDoS, DNS, wireless, on-path, credential replay, and malicious-code activity.
Injection, buffer overflow, replay, privilege escalation, forgery, and directory traversal.
Differentiate brute force from password spraying and investigate unusual sessions.
One weakens negotiated security; the other exploits hash collision properties.
Account lockouts, impossible travel, resource spikes, inaccessible files, and missing logs need context.
⚡ Exam Tips — Lesson 02.5
- Match a specific behavior to the most likely attack family.
- Look at how authentication failures are distributed to distinguish brute force from password spraying.
- Correlate resource spikes, traffic floods, or service outages with network and endpoint logs.
- Remember that unexpected elevated access may indicate privilege escalation, but confirm the account’s role and approved changes.
- Treat impossible travel, concurrent sessions, blocked content, and missing logs as indicators that require validation.
- Preserve relevant evidence and follow the organization’s incident-response procedures.
⚠️ Common Pitfalls — Lesson 02.5
📋 Complete Security+ SY0-701 Guide Series — 5 Domains
Further Reading and Related Guides
Continue learning on NetworkUstad:
- Security+ Domain 2.0 Guide Hub — browse the Domain 2 lesson sequence.
- Security+ SY0-701 Guide Hub — access the full certification series.
External references:
- MITRE ATT&CK: Credential Access — credential theft techniques and related behaviors.
- MITRE ATT&CK: Valid Accounts — how legitimate credentials can be abused by adversaries.
- OWASP Top 10 — web application risk and attack context.
