2.4 Scenarios and Indicators of malicious activity

Ransomware (Malware attack)

Encrypts files and demands payment for decryption ( WannaCry Encrypting hospital systems)

Trojan (Malware attack)

Malware disguised as legitimate software (Fake flash player installer that installs backdoor)

Worm (Malware Attacks)`

Self Replicating malware that spreads without user input (ILOVEYOU worm spreading via email)

Spyware (Malware attack)

Secretly monitors and collects user data (Keylogger sending typed data to attacker)

Bloatware (Malware attack)

Unwanted software preinstalled or bundled (Trail antivirus slowing down systems)

Virus (malware attack)

infects and spreads by attaching to files or programs (Melissa virus in word documents)

Keylogger (Malware attack)

Records keystrokes to capture sensitive data, works synonymous with spyware (Example, capturing passwords typed into websites)

Logic Bomb (Malware attack)

Malicious code triggered by specific conditions
(Code that deletes files if user is fired, or a action is trigger)

Rootkit (Malware Attack)

Hides malware or attacker presence on system (Kernel mode rootkit hiding backdoors)

Brute Force ( Physical attack)

Repeatedly tries passwords or PINs, forcing to login (Using a login automation tool to sign in)

RFID cloning (Physical Attack, Radio Frequency identification)

Copies RFID chip data to a fake card (Cloning badge access badge or credit card information)

Environmental (Physical Attack)

Damage from temperature, humidity, power, etc (Server overheating due to a AC failure)

DDoS (Network attack)

Overloads service with excessive traffic (Bot net flooding a website) (Denial of distributed service)

Amplified DDOS ( Network )

Attack magnified using protocols like NTP or DNS (A small request, resulting in a massive response, flooding the target)

Reflected DDos (Network)

Spoofed request responses flood the victim (Sending spoofed ping requests to many devices)

DNS attacks (Network Attack)

Exploit DNS to redirect or intercept traffic (Poisoning DNS to reroute bank users to fake sites)

Wireless (Network attacks)

Exploits wireless protocols or encryption (Cracking a WPA2 key using handshake capture)

On Path (Network Attacks)

intercepts communication between two parties (Man in the middle attack capturing credentials over public wifi)

Credential replay (Network attacks)

Reuses stolen credentials to access system (Using sniffed cookies to access accounts)

Malicious Code (Network Attack)

General term for code that’s used to harm (Like a JS injected into a login page)

Buffer Overflow (Application Attacks)

Overwrites memory to execute attacker code

(Input overflow app memory buffer)

Injection (Application Attacks)

Injects code into apps or systems (SQLi or command injection in input fields)

Replay (Application attacks)

Captures and reuses valid data packets (Reusing a login request to gain access)

Privilege Escalation (Application Attacks)

Gains higher level permissions (User exploiting bug to become admin)

Forgery (Application Attacks)

Faking a request or message as legitimate (CSRF attack forging a user action)

Directory Traversal (Application attack)

Accessing files outside allowed directory (using linux to access ../../etc/passwd to read system files)

Downgrade (Cryptographic attacks)

Forces use of weak encryption (TLS downgrade to insecure version)

Collision (Cryptographic attacks)

Two inputs producing same hash output (MD5 producing same hash for different files, therefore colliding)

Birthday (Cryptographic attacks)

Probability based hash collision attack (Two file having the same SHA1 hash)

Spraying (Password Attacks)

Trying a few common passwords on many accounts (Trying “Password123” on all users or accounts)

Brute Force password (Password)

Trying all combinations to crack a password (Example, cracking 6 character PIN via tools/automation)

Account Lockout (Indicator)

Too many login attempts, therefore the user is locked out after failed attempts

Concurrent Session Usage (Indicator)

Account accessed from multiple locations, like being logged in from the US and in China at once

Blocked Content (Indiciator)

Security tool prevents malicious data, like a firewall blocking a malicious domain

Impossible Travel (Indicator)

Logins from distant locations in unrealistic time, like a login from US and then 2 minutes later, a login from Russia. Similar to congruent session.

Resource consumption (Indicator)

Unusually use of CPU, Ram, ETC, could be a crypto mining malware spiking CPU usage

Resource inaccessibility (Indicator)

System or service becomes unreachable, like a DDoS attack making a public website inaccessible.

Out OF cycle logging (indicator)

Unexpected or off schedule log entries, like a log appearing during off hours or maintenance window.

Published/Documented (Indicator)

Known indiactors listed by threat intel, IOC from MITRE ATT&CK used in alerts

Missing Logs (indicator)

Expected logs, not recording, like a SIEM showing gaps in log records, possibly an intent to conceal identity.