CompTIA Security+ SY0-701 · Free study guide

Objective 2.4 — Interpret signs of malicious activity

Indicators become useful when combined across time and sources. One failed login may be user error; a low-and-slow sequence against many accounts may indicate password spraying. An investigation should form competing hypotheses, identify what evidence would distinguish them, and avoid treating a single alert as proof.

Malware and host behavior

Ransomware commonly combines file changes, disabled recovery mechanisms, unusual process execution, credential access, lateral movement, and ransom messaging. A Trojan presents as legitimate software, while a worm can propagate without each victim launching it manually. Spyware collects information; a keylogger records input; a logic bomb waits for a condition before executing. A rootkit hides or preserves privileged access. Viruses attach to host content, whereas bloatware is unwanted excess software and is not necessarily malicious.

Host indicators may include impossible parent-child process relationships, unsigned executables in user-writable paths, persistence changes, security-tool tampering, unexpected encryption activity, resource exhaustion, or outbound connections to rare destinations. Preserve volatile evidence before rebooting when the response plan requires it.

Identity, application, and network clues

Password spraying tries a small number of common passwords across many accounts to avoid per-account lockout. Brute force makes repeated guesses against a target. Credential replay reuses captured authentication material. Concurrent sessions from distant locations, lockout spikes, new MFA registrations, and access outside a user’s role can support an identity-compromise hypothesis.

Application indicators include injection-shaped input, traversal sequences, unexpected privilege changes, forged requests, and access to resources outside the normal route. A sudden server error can be a bug or attack; correlate request data, code behavior, and downstream queries.

Network attacks may involve denial of service, distributed denial of service, DNS manipulation, rogue wireless infrastructure, on-path interception, credential replay, or malicious code delivery. Look for traffic asymmetry, unusual protocol use, duplicate authentication material, name-resolution changes, new gateways, and timing patterns.

Application attacks include injection, buffer overflow, replay, privilege escalation, request forgery, and directory traversal. Cryptographic attacks require their own evidence. A downgrade attack forces weaker protocol or algorithm negotiation. A collision occurs when different inputs produce the same digest; a birthday attack exploits the probability of finding such a pair rather than reversing one chosen digest. Do not label an ordinary authentication replay a hash collision merely because credentials were reused.

Physical evidence matters too. Forced-entry or physical brute-force damage, an RFID badge clone used impossibly close to the legitimate badge, and environmental anomalies such as unexpected heat, water, smoke, or power loss can indicate malicious activity or a safety event. Correlate access-control, camera, badge, facility, and system evidence before assigning intent.

Analysis discipline

Build a timeline in a consistent time zone, retain original evidence, and record confidence. Distinguish an indicator from an incident scope conclusion. Account lockouts, concurrent sessions, blocked content, impossible travel, resource consumption, resource inaccessibility, out-of-cycle logging, unexpectedly published documents, and missing logs are leads—not conclusions. First rule out collection failure, approved maintenance, capacity incidents, and other benign explanations. If endpoint telemetry shows a suspicious process, network evidence can confirm destinations, identity logs can reveal the account, and application logs can show the affected actions.

Decision rule: choose the explanation that accounts for the complete pattern with the fewest unsupported assumptions, then collect evidence that could disprove it.