Study guide 13: Indicators of malicious activity
Domain 2: Threats, Vulnerabilities & Mitigations · Not started
Main exam topics
Threat actors and motivations; attack surfaces; phishing and social engineering; malware; network and application attacks; software, hardware, cloud and supply-chain vulnerabilities; indicators of attack; patching, isolation, segmentation and access controls.
SY0-701 topic overview · Independent study resource, not a prediction of exam questions.
Lesson plan · 90 minutes
By the end of this lesson you will be able to:
- Identify ransomware, trojans, worms, rootkits, keyloggers and logic bombs
- Recognize physical, wireless and network attack indicators
- Detect injection, XSS, replay and privilege escalation
- Interpret indicators such as impossible travel and account lockout
Topic 13A — Malware
Ransomware encrypts or steals data for payment. Trojans disguise malware as legitimate software; RATs and backdoors provide remote control. Worms self-propagate. Spyware and keyloggers capture activity. Rootkits hide at kernel or firmware level. Logic bombs trigger on a condition. Fileless malware lives in memory and uses built-in tools like PowerShell. Indicators: account lockouts, concurrent sessions, impossible travel, resource consumption, blocked content, missing logs and out-of-cycle logging.
Topic 13B — Physical and network attacks
Physical: brute-force entry, RFID cloning, environmental attacks. Network: DDoS (including amplification and reflection), DNS poisoning, on-path attacks, ARP spoofing, evil twin and rogue access points, wireless deauthentication, credential replay and pass-the-hash. Password attacks include spraying (one password, many accounts) and brute force.
Topic 13C — Application attacks
Injection (SQL, command), cross-site scripting, cross-site request forgery, directory traversal (../), buffer overflow, privilege escalation, replay and forgery. Look for unusual characters in URLs and logs, unexpected outbound connections and errors.
Saved