CoreQ Academy2.4 Given a scenario, analyze indicators of malicious activity.
This is the analyst objective: look at symptoms (logs, alerts, user reports) and identify what attack is happening. Practise by reading real log lines in the CoreQ auth-log labs.
Malware attacks
- Ransomware
- Encrypts files and demands payment; modern variants also steal data first (double extortion). Indicators: mass file renames, ransom notes, high disk activity.
- Trojan
- Malware disguised as legitimate software. Remote access trojans (RATs) give the attacker control.
- Worm
- Self-replicates across networks without user action, exploiting vulnerabilities. Indicator: rapid spread and unusual network scanning.
- Spyware
- Secretly monitors activity and collects information.
- Bloatware
- Unwanted pre-installed software that wastes resources and can add vulnerabilities.
- Virus
- Attaches to files or programs and needs user action to spread.
- Keylogger
- Records keystrokes to capture passwords and messages.
- Logic bomb
- Malicious code that triggers on a condition or date, often planted by an insider.
- Rootkit
- Hides deep in the OS or firmware with high privileges to conceal itself and other malware.
Physical attacks
- Brute force (physical)
- Forcing entry: breaking locks, doors or windows.
- Radio frequency identification (RFID) cloning
- Copying an access badge signal to make a duplicate.
- Environmental
- Attacking power, cooling or fire suppression to cause outages.
Network attacks
- Distributed denial-of-service (DDoS)
- Many systems flood a target to make it unavailable.
- Amplified
- Small requests trigger large responses (for example DNS or NTP) directed at the victim.
- Reflected
- Requests are sent with the victim spoofed as the source, so responses hit the victim.
- Domain Name System (DNS) attacks
- DNS poisoning, hijacking or tunnelling to redirect users or exfiltrate data.
- Wireless
- Evil twin access points, deauthentication attacks, jamming.
- On-path
- An attacker sits between two parties to read or alter traffic (formerly man-in-the-middle), e.g. via ARP poisoning.
- Credential replay
- Capturing and reusing authentication data such as session tokens or hashes (pass-the-hash).
- Malicious code
- Scripts or payloads delivered over the network to compromise systems.
Application attacks
- Injection
- Untrusted input interpreted as commands (SQL, OS command, LDAP).
- Buffer overflow
- Overwriting memory to crash or take control of a program.
- Replay
- Resending captured valid data, such as a request or token, to repeat an action.
- Privilege escalation
- Gaining higher permissions than granted, vertically (user to admin) or horizontally (to another user).
- Forgery
- Tricking a system into making a request on the attacker behalf: CSRF in browsers, SSRF on servers.
- Directory traversal
- Using ../ sequences to reach files outside the intended folder.
Cryptographic attacks
- Downgrade
- Forcing a connection to use an older, weaker protocol or cipher.
- Collision
- Two different inputs produce the same hash, breaking integrity guarantees (MD5, SHA-1).
- Birthday
- Uses probability to find collisions faster than expected; defeated by longer hash outputs.
Password attacks
- Spraying
- Trying a few common passwords across many accounts to avoid lockouts. Indicator: failures spread across many usernames from one source.
- Brute force
- Trying many passwords against one account. Indicator: repeated failures for the same user.
Indicators
- Account lockout
- Accounts locking unexpectedly suggest password guessing.
- Concurrent session usage
- The same account active in two places at once.
- Blocked content
- Security tools blocking downloads or sites; repeated blocks can signal infection.
- Impossible travel
- Logins from locations too far apart for the time between them.
- Resource consumption
- Unusual CPU, memory, disk or bandwidth use, e.g. crypto-mining or exfiltration.
- Resource inaccessibility
- Files or services suddenly unavailable, e.g. encrypted by ransomware.
- Out-of-cycle logging
- Log entries at odd times, such as admin activity at 3 a.m.
- Published/documented
- The attack or your data appears publicly, for example on a leak site.
- Missing logs
- Gaps in logs can mean an attacker deleted evidence.
The auth log shows one IP failing to log in once each as admin, alice, bob, carol and dave using the password "Winter2026!", then nothing for 30 minutes, then repeating. What is it?
Show answer
Password spraying: one or two common passwords tried across many accounts, slowly, to stay under lockout thresholds.
Hands-on practice
Check your understanding
Knowledge quiz · pass mark 80%
- Gaps in logs during an incident can themselves be an indicator of compromise.
- A request containing ../../etc/passwd indicates:
- Malware that spreads across the network on its own by exploiting a vulnerability is a:
- A user logs in from Atlanta and, 10 minutes later, from Singapore. This indicator is:
- Many usernames each fail once with the same password from one IP. This is:
- Forcing a TLS connection to use an old, weak protocol version is a:
- Attackers send small DNS queries with the victim's spoofed address that produce large responses. This is:
Original CoreQ Academy material, mapped to objective 2.4 of the publicly available CompTIA Security+ SY0-701 exam objectives (Exam objectives V7, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.