Cyberstudy
PDF p.344 In progress

Malicious Activity Indicators

Open PDF at p.344 19 flashcards

Summary

PDF p.344

Malicious activity indicators help identify the presence of malware. These indicators can be obvious, like changes in browser settings, or subtle, requiring detailed analysis of system behavior.

Detailed explanation

PDF p.344
  • Sandbox Execution
    • Definition: Isolated environment to analyze suspect code or hosts.
    • Function: Records file system, registry changes, and network activity.
    • Sheep Dip: Isolated host for testing new software and removable media.
  • Resource Consumption
    • Indicators: Excessive CPU usage, memory leaks, disk activity, network bandwidth consumption.
    • Investigation: High resource consumption can indicate malware but may also be due to other issues.
    • Examples: Botnet DDoS, cryptojacking, crypto-ransomware.
  • File System
    • Interaction: Malware may interact with the file system and registry.
    • Metadata Analysis: Check file creation, access, modification times.
    • Blocked Content Indicators: Access denied messages, DLP system logs.
  • Resource Inaccessibility
    • Definition: Network, host, file, or database is unavailable.
    • Indicators: Denial of Service (DoS) attacks, ransomware, disabled scanning utilities.
  • Account Compromise
    • Indicators
      • Account Lockout: Too many failed authentication attempts.
      • Concurrent Session Usage: Multiple logins from different locations.
      • Impossible Travel: Logins from geographically impossible locations.
  • Logging
    • Indicators
      • Missing Logs: Deleted log files.
      • Unusual Gaps: Gaps between log entry times.
      • Out-of-Cycle Logging: Manipulated timestamps.

Important terms

taken from the text above
Sandbox Execution
Isolated environment to analyze suspect code or hosts.
Sheep Dip
Isolated host for testing new software and removable media.
Investigation
High resource consumption can indicate malware but may also be due to other issues.
Interaction
Malware may interact with the file system and registry.
Metadata Analysis
Check file creation, access, modification times.
Blocked Content Indicators
Access denied messages, DLP system logs.
Resource Inaccessibility
Network, host, file, or database is unavailable.
Account Lockout
Too many failed authentication attempts.
Concurrent Session Usage
Multiple logins from different locations.
Impossible Travel
Logins from geographically impossible locations.
Missing Logs
Deleted log files.
Unusual Gaps
Gaps between log entry times.
Out-of-Cycle Logging
Manipulated timestamps.
DoS Denial of Service

What I should remember

Key Points PDF p.344
  • Sandbox Execution
    • Isolated Analysis: Records changes and activity.
    • Sheep Dip: Tests new software/media.
  • Resource Consumption
    • Indicators: High CPU, memory, disk, network usage.
    • Examples: Botnet DDoS, cryptojacking.
  • File System
    • Interaction: Malware behavior in file system and registry.
    • Metadata: Analyze file times, check for suspicious files.
  • Resource Inaccessibility
    • Indicators: DoS attacks, ransomware.
  • Account Compromise
    • Indicators: Account lockout, concurrent sessions, impossible travel.
  • Logging
    • Indicators: Missing logs, unusual gaps, manipulated timestamps.