Malicious activity

This objective is highly practical. CompTIA will present you with a realistic technical scenario, such as an administrator reviewing log files, network traffic, or unusual system behavior- and you must diagnose exactly which type of attack or malware is causing those indicators.

Let’s break this down by analyzing the attacks alongside their signature indicators.

1. Malware Attacks & Indicators

Malware types have distinct operational signatures that instantly reveal their identities during analysis.

• Ransomware: Encrypts data and demands payment.
  • Indicators: Suddenly finding files with strange, randomized extensions (e.g., budget.xlsx.locked), an inability to open documents (resource inaccessibility), and a text file desktop pop-up containing payment instructions.
• Trojan: Malicious software disguised as something legitimate.
  • Indicators: A user downloads a free utility or game, and shortly after running it, unauthorized remote connections begin to leave their workstation.
• Worm: Self-replicating malware that spreads across a network without human intervention.
  • Indicators: A massive, sudden spike in local network traffic and a rapid cascade of corporate servers crashing or slowing down one after another (resource consumption).
• Spyware & Keyloggers: Software designed to covertly monitor and record user activity.
  • Indicators: Extreme browser sluggishness, search queries constantly redirecting to strange websites, or an endpoint transmitting plain-text files containing keystroke histories to an unknown external IP address.
• Bloatware: Unnecessary, unwanted software pre-installed on new hardware by manufacturers. While not explicitly malicious, it consumes valuable system resources and expands the attack surface.
• Virus: Malicious code that attaches itself to a legitimate host application and requires human action (like executing the program) to run and replicate.
• Logic Bomb: Malicious code deliberately planted to execute only when triggered by a specific event or date.
  • Indicators: A system suddenly wipes its own master boot record out of nowhere, and the incident response team finds a script configured to run only if a specific employee’s user ID is deleted from Active Directory (out-of-cycle logging or missing logs).
• Rootkit: Deeply embedded malware that modifies system files to gain administrative access and hide its presence from the OS and standard antivirus tools.
  • Indicators: A system behaves erratically or shows massive hidden outbound traffic, but Task Manager shows 0% CPU utilization. The malware is lying to the OS kernel.

2. Network & Wireless Attacks

These attacks target the infrastructure that connects your systems, aiming to disrupt availability or intercept data.

• DDoS (Distributed Denial-of-Service): Using a botnet (a network of compromised devices) to flood a target with traffic.
  • Reflected: The attacker sends requests to legitimate third-party servers (like public NTP or DNS servers) while spoofing the victim’s IP address. All the servers reply to the victim rather than the attacker.
  • Amplified: A type of reflected attack where the attacker wraps their request in a way that forces the third-party server to send a massive response. (e.g., a 1-byte request generates a 50-byte response that is sent directly to the victim, completely overwhelming their bandwidth).
• DNS Attacks: Manipulation of the Domain Name System.
  • Indicators: Users entering bank.com but being silently redirected to an IP address hosting a phishing clone site, or a server generating thousands of unusual outbound DNS queries to random subdomains (DNS Tunneling used to sneak data out past firewalls).
• Wireless Attacks: Targeting Wi-Fi or Bluetooth.
  • Indicators: Finding an unapproved access point broadcasting the exact same SSID as the corporate network (an Evil Twin or Rogue AP) trying to trick employees into connecting.
• On-Path (Man-in-the-Middle): An attacker intercepts or alters communications between two parties without their knowledge.
  • Indicators: Sudden browser warnings about invalid, self-signed certificates when navigating to a public site like Google while connected to an office network.
• Credential Replay: Capturing an authentication packet off the network wire and resending it later to gain unauthorized access without ever knowing the actual password.

3. Application, Cryptographic, & Password Attacks

These target software logic, mathematical controls, and user access points.

• Injection (SQLi / Command Injection): * Indicators: Web server logs filled with characters like ' OR '1'='1 or ; rm -rf inside the input parameters of URL query strings.
• Buffer Overflow:
  • Indicators: System logs recording sudden application crashes pointing to memory segmentation faults, alongside registers containing repetitive sequences like 0x41414141 (the hex representation of “AAAA”, indicating an attacker stuffed the memory buffer).
• Directory Traversal: An attacker attempts to navigate outside the web server’s root folder to access restricted OS system files.
  • Indicators: Web logs showing repeated attempts to pull files using the ../ pattern (e.g., GET /../../etc/passwd).
• Privilege Escalation: An attacker with a standard user account exploits a local flaw to elevate themselves to an administrative role.
  • Indicators: A standard employee account suddenly running administrative commands like sudo or changing system registries.
• Cryptographic Attacks:
  • Downgrade Attack: Forcing a server to abandon secure, modern cryptographic protocols in favor of older, breakable ones (e.g., downgrading a TLS 1.3 connection to SSL 3.0 to crack the encryption).
  • Collision / Birthday Attack: Exploiting statistical probabilities to find two distinct inputs that produce the same hash value, allowing an attacker to substitute a malicious file for a legitimate one.
• Password Attacks:
  • Brute Force: Testing thousands of passwords against a single account in rapid succession. Indicator: Hundreds of account lockouts occurring for one specific username within minutes.
  • Password Spraying: Testing a few incredibly common passwords (Password123!, Summer2026) across thousands of different usernames simultaneously. Indicator: A slow, quiet wave of single failed login attempts spread across every account in the organization, designed to intentionally bypass automatic account lockout thresholds.

4. Key Indicators of Compromise (IoCs)

CompTIA expects you to recognize these generic system and account red flags:

Indicator	Technical Reality / Real-World Example
Account Lockout	A user arrives at work to find their account locked before they even type their password. (Sign of a targeted brute force or spraying attack).
Concurrent Session Usage	Active Directory shows User A is actively logged into a workstation in the accounting office, while simultaneously opening an active session on a server from the sales floor.
Blocked Content	Firewalls or web filters suddenly lighting up with blocks for outbound communication to known malicious IP addresses or foreign command-and-control servers.
Impossible Travel	A cloud application logs a successful user sign-in from Phoenix, Arizona, and then 20 minutes later logs a successful sign-in for the exact same account from Tokyo, Japan.
Resource Consumption	A critical server’s CPU and RAM utilization pinning at 100% out of nowhere, often an indicator of a rogue crypto-miner, malware propagation, or an active DDoS.
Out-of-Cycle Logging	High volumes of database read/write event logs are generated at 3:00 AM on a Sunday, when the business is entirely closed.
Missing Logs	An administrator opens a critical security log file only to find a massive, unexplained multi-hour gap in the event data, indicating an attacker manually cleared the files to hide their tracks.