Section 6.58 Indications of Malware attacks Flashcards
Objectives 2.4 Given a Scenario, analyse indicators of malicious activity
Indications of Malware Attacks
1 Account Lockouts
Malware, especially those designed for credential theft or brute force
attacks, can trigger multiple failed login attempts that would result in a
user’s account being locked out
Indications of Malware Attacks
2 Concurrent Session Utilization
If you notice that a single user account has multiple simultaneous or concurrent sessions open, especially from various geographic locations
Indications of Malware Attacks
3 Blocked Content
If there is a sudden increase in the amount of blocked content alerts you are seeing from your security tools
Indications of Malware Attacks
4 Impossible Travel
Refers to a scenario where a user’s account is accessed from two or more
geographically separated locations in an impossibly short period of time
Indications of Malware Attacks
5 Resource Consumption
If you are observing any unusual spikes in CPU, memory, or network
bandwidth utilization that cannot be linked back to a legitimate task
Indications of Malware Attacks
6 Resource Inaccessibility
Ransomware
○ Form of malware that encrypts user files to make them
inaccessible to the user
If a large number of files or critical systems suddenly become inaccessible or if users receive messages demanding payment to decrypt their data
Indications of Malware Attacks
7 Out-of-Cycle Logging
If you are noticing that your logs are being generated at odd hours or
during times when no legitimate activities should be taking place (such as in the middle of the night when no employees are actively working)
Indications of Malware Attacks
8 Missing Logs
If you are conducting a log review as a cybersecurity analyst and you see that there are gaps in your logs or if the logs have been cleared without any authorised reason
Indications of Malware Attacks
9 Published or Documented Attacks
If a cybersecurity research or reporter published a report that shows that your organization’s network has been infected as part of a botnet or other malware-based attack
