Threat, Vulnerabilities and Mitigations: Indicators of Network Attacks

Question 1

What are some signs of DDoS attacks?

Answer 1

These types of attacks, known as DDoS attacks, are network-based and are typically indicated by:

High network-bandwidth utilization and inbound traffic.

Can’t access network services, such as websites, the cloud, and servers.

Can’t access your network.

Overloaded network appliances:

-DDoS attacks can be used to crash firewalls and Intrusion Detection
Systems (IDS) and intrusion prevention services (IPS).

Question 2

What are signs of DNS attacks?

Answer 2

Domain name system (DNS) attacks can include:

Domain takeover and hijacking.

Domain spoofing and poisoning:

Static DNS set for Network Adapter in Windows 

hosts file 

resolv.conf file 

Poisoned DNS cache: 

ipconfig /all 

ipconfig /displaydns

Question 3

What are signs of Wireless attacks?

Answer 3

Hallmarks of wireless attacks are:

Poor network performance over Wi-Fi.

Unauthorized devices on network: check the list of connected hosts using the admin console.

Changes to access point (AP) or router settings:

-Service set identifier (SSID)

-Password or pre-shared key (PSK)

-DNS

-Firewall rules

Question 4

What are the signs of Inability of connecting to Wi-Fi?

Answer 4

Inability to connect to Wi-Fi:

Disassociation and/or deauthentication attack.

Jamming

Question 5

What are signs of Rogue AP attack?

Answer 5

Rogue APs and/or Evil Twins:

Unusual requests for network credentials.

Question 6

What are the signs of MiTM/On Path Attack?

Answer 6

Man-in-the-middle (MiTM) or on-path attack indicators can include:

Anything strange with Secure Sockets Layer (SSL)/Transport Layer Security (TLS)

Warnings

Mismatches: compare to certification for the site in question

Unexpected login prompts

Strange emails, such as responses to emails you never sent or odd responses to messages you did send.

Unexpected SMS verifications.

Question 7

What signs of a Credential replay being actioned?

Answer 7

Credential replays

Indicators can include:

 Unexpected account lockouts: an attacker might be trying to reuse 
 credentials repeatedly. 

Unusual login activity, such as:

Email notifications that a new login has occurred 

Emails that contain privileged information, such as:

Device Type 

Operating system (OS) 

IP 

Geolocation 

Time of log in 

Suspicious account changes, such as modifications to:

Phone numbers. 

Backup accounts. 

Signed-in devices.

Question 8

What are some signs of using malicious codes for a network attack?

Answer 8

Hallmarks can include:

Known Command and Control (C2) traffic.

Data exfiltration.