Objective 2.4Threats & Vulnerabilities· 4 min read

Analysing Indicators of Malicious Activity

Given a scenario, analyze indicators of malicious activity

What you will learn

Name the malware families and tell them apart by what they do, not by what they are called.
Distinguish the three password attacks: spraying, brute force, and dictionary.
Read the indicators of network attacks: distributed denial of service, on-path, and credential replay.
Know the cryptographic attacks: downgrade, collision, and birthday.

This objective is analytic: it asks for inference, not definitions. You are given signals and asked for the attack. The skill is knowing which signal separates each attack from its neighbour — because many of them look alike in effect and differ in the trace they leave in the log.

Malware

Ransomware	Encrypts data and demands payment. Its markers: files with an odd extension, a ransom note, and a sudden spike in write operations.
Trojan	Disguised as something useful. The user installs it themselves.
Worm	Spreads by itself across the network with no human action. Its marker: rapid lateral spread between machines.
Virus	Attaches to a file or program and needs the user to run it in order to spread.
Rootkit	Hides itself by altering the system, so tools running above it may not see it.
Keylogger	Records keystrokes to steal credentials.
Logic bomb	Dormant code that fires on a condition: a date, or an employee's name disappearing from payroll.
Spyware / Bloatware	The first watches covertly; the second is surplus software shipped with a device, widening the attack surface for no benefit.

Worm vs virus

	Worm	Virus
Spread	By itself, over the network	Needs a user to run it
The indicator	Many machines infected quickly with no human action	Infection follows opening a file or running a program

Password attacks

Password spraying	One common password tried against many accounts. Its marker: one or two failures per account across hundreds of accounts — so no account locks out.
Brute force	Many possibilities against one account. Its marker: tens or hundreds of failures on the same account.
Dictionary attack	Brute force guided by a list of likely words instead of every combination.

Spraying vs brute force — read the direction

Both are failed logins; the difference is the direction. Brute force: one account, many attempts — the account locks and alarms fire. Spraying: many accounts, one or two attempts each — nothing locks and nobody is alerted, which is the whole reason it exists. If the question says "a single failure across hundreds of accounts", it is spraying.

Network and cryptographic attacks

DDoS	Flooding a service from many sources until it cannot cope. The goal is disruption, not theft.
On-path (MITM)	The attacker sits between the two ends, reading or altering what passes. Its marker: an unexpected certificate or a TLS warning.
Credential replay	Capturing a valid credential and re-sending it later. It never needs to crack the password.
DNS attacks	Poisoning or hijacking DNS so a correct name resolves to the attacker's server.
Downgrade attack	Forcing both ends onto a weaker cryptographic version the attacker knows how to break.
Collision	Two different inputs producing the same hash. It destroys any reliance on hashing to prove integrity.
Birthday attack	A probabilistic technique making a collision far easier to find than intuition suggests.

Real-world example: reading a log

In the identity server's log: 240 failed logins over six minutes, from one address, spread across 238 distinct usernames, with no account locked out — then one success. Do not say brute force: brute force concentrates on one account and locks it. Spreading attempts across hundreds of accounts at one try each is the definition of password spraying — and the attacker chose it precisely to slip under the lockout policy. That final success means one account was using the common password being tried.

What matters on the exam

Read the distribution, not the count: many attempts on one account = brute force; few attempts across many accounts = spraying.
"Spread with no user action" = worm. "The user installed it thinking it was useful" = trojan.
A time or event condition triggering code = logic bomb, usually in the context of a departing employee.
An unexpected certificate warning on a connection that used to work = an on-path attack, not a network fault.
Credential replay never cracks the password. If the question says the credential was valid, stop looking for broken crypto.

Quick check

Answer in your head first, then reveal.

Forty machines are infected within an hour with nobody opening anything. What kind of malware?Reveal the answer
A worm: self-propagation across the network with no human action is what separates it from a virus, which needs to be run.
How do you tell password spraying from brute force using the log alone?Reveal the answer
By the number of accounts, not the number of attempts: spraying touches many accounts with one or two tries each and locks nothing; brute force concentrates on one account and usually locks it.
What is a downgrade attack for?Reveal the answer
To force both ends to negotiate a weaker cryptographic version the attacker can break, instead of attacking the strong one head-on. The defence: disable the old versions in configuration.
A site stops responding under a flood of requests from thousands of addresses. Which attack, and which part of the triad?Reveal the answer
A distributed denial of service, targeting availability. Nothing is stolen or altered — the disruption is the goal.

Your next step

Read the lesson, then mark it complete

Practise this topic · 6 questions

Sources

Used to verify the facts. The writing is original to Passuit.