Objective 2.4: Given a scenario, analyze indicators of malicious activity

Cert: CompTIA Security+ (SY0-701) Domain: 2.0 Threats, Vulnerabilities, and Mitigations Weight: ~22% of SY0-701 (Domain 2 total) Depth: Apply / Analyze. Read a SIEM alert, name the suspected attack category, name the indicator that gave it away, and pick the next action.

What this objective tests

You should be able to recognize the common malware families and the network, application, cryptographic, and password attacks by their indicators. The exam puts you in the SOC Tier 1 analyst seat. You are handed a short scenario (an alert summary, a log snippet, a user report) and you need to name the category and the specific attack, then decide on the next step. This is the most scenario-heavy objective in Domain 2. Drill the indicator-to-category mapping until it is reflex.

Key facts

The five attack categories (plus password attacks)

CompTIA groups the SY0-701 attacks into five categories. Password attacks sit next to them as a tightly related sixth set. Knowing the category narrows the playbook before you touch a tool.

Category	Examples	Indicator center of gravity
Malware	Ransomware, trojan, worm, spyware, bloatware, virus, keylogger, logic bomb, rootkit	Endpoint behavior, file changes, process trees
Physical	Brute force on doors and locks, RFID cloning, environmental tampering	Badge logs, alarms, door sensors
Network	DDoS, DNS attacks, wireless, on-path, credential replay, malicious code	Traffic patterns, DNS, wireless logs
Application	Injection, buffer overflow, replay, privilege escalation, forgery (CSRF/SSRF), directory traversal	Web logs, app errors, EDR process telemetry
Cryptographic	Downgrade, collision, birthday	Protocol audits, vulnerability scans, mismatched hashes
Password	Spraying, brute force	Identity provider logs, lockouts, failed-login patterns

Malware families: the nine

These are the malware families named in the exam objective. Most real incidents combine several. A ransomware attack often arrives as a trojan, drops a rootkit for persistence, and uses worm-like spreader code on the LAN. Naming the dominant family is the analyst's first move because the family decides the containment playbook.

Family	Plain English	Typical indicators
Ransomware	Encrypts files and demands payment for the key	High-rate file rename, new crypto extension, ransom note, shadow copy deletion
Trojan	Malware hiding inside a program the user trusted	Unknown process from a user folder or temp folder, suspicious child of a legitimate parent
Worm	Spreads on its own across the network. No click needed	Sudden LAN-wide SMB or RPC scanning, identical infections across many hosts
Spyware	Quietly collects and exfiltrates information	Outbound connections to unusual domains, browser history collection, screen capture activity
Bloatware	Unwanted vendor software that wastes resources and may expose risk	Pre-installed apps with phone-home traffic, vulnerable libraries shipped with the OEM image
Virus	Attaches to a host file and runs when the host runs	File hash changes on previously known-good binaries, AV signature hits
Keylogger	Records every keystroke	Keyboard input written to an unexpected file, USB device adding a new HID (Human Interface Device)
Logic bomb	Triggers when a condition is met (date, missing record, fired employee)	Dormant code path activated by a calendar or HR event
Rootkit	Hides itself and other tools deep in the operating system	Kernel-level hooks, hidden processes, EDR blind spots, files that disappear when listed

Physical attacks

Physical attacks sit at the boundary of cyber and physical security. They are not common SOC tickets but they show up in scenario questions and in red-team reports.

Brute force. Forcing a door, a lock, or a hardware token. Indicator: physical alarm, door-open-too-long event.
RFID cloning. Copying a badge or fob to bypass an access control vestibule. Indicator: the same badge ID used in two impossible locations within minutes.
Environmental. Cutting power, flooding a room, overheating a rack. Indicator: UPS (Uninterruptible Power Supply) alerts, temperature or water sensors firing.

Network attacks

Network attacks live in the wire. The indicators show up in firewall logs, IDS/IPS (Intrusion Detection / Prevention System) signatures, NetFlow, and packet capture.

DDoS (Distributed Denial of Service). Floods a target from many sources. Two important subtypes for the exam.
Amplified. A small attacker request triggers a large response. Open DNS resolvers and NTP (Network Time Protocol) servers are classic amplifiers.
Reflected. The attacker spoofs the victim's IP as the source so the response goes to the victim, not the attacker.
DNS attacks. Cache poisoning, domain hijacking, and DNS tunneling for data exfiltration. Indicator: unexpected name resolutions, oddly long TXT record traffic.
Wireless attacks. Rogue access points, evil twins, deauthentication. Indicator: unauthorized SSIDs, repeated deauth frames in a wireless capture.
On-path attack. An attacker sits between two parties and reads or alters traffic. Formerly called man-in-the-middle. SY0-701 uses "on-path attack."
Credential replay. A captured authentication is replayed by the attacker to impersonate the user.
Malicious code. A delivery vector. The attacker uses the network to drop one of the malware families on a target endpoint.

Application attacks

Application attacks live in the app's code path. The indicators show up in web server access logs, application error logs, WAF (Web Application Firewall) blocks, and EDR (Endpoint Detection and Response) process telemetry.

Injection. Crafted input that the app runs as code.
SQL injection. Input that becomes part of a database query.
Command injection. Input that becomes part of an operating system command.
LDAP / XML injection. Input that becomes part of a directory query or XML document.
Buffer overflow. Writing past the end of a memory buffer to corrupt other memory or run attacker code. Indicator: app crash, suspicious child process spawned by a long-running service.
Replay. Capturing a valid request and sending it again. Indicator: identical-looking requests with the same session token from different IPs.
Privilege escalation. Going from a normal user to a higher-privileged user. Local escalation to local admin or domain escalation to domain admin.
Forgery. Two flavors on this exam.
CSRF (Cross-Site Request Forgery). The user's browser is tricked into making a request the user did not intend.
SSRF (Server-Side Request Forgery). The server is tricked into making a request the attacker chose, often to internal infrastructure.
Directory traversal. Sneaking out of the intended folder using path tricks like ../. Indicator: URL paths like /files/../../etc/passwd or /static/..%2f..%2fweb.config.

Cryptographic attacks

These are the three cryptographic attacks on SY0-701. Most analysts will not see them every day. They show up in vulnerability scan output, TLS audits, and post-incident analysis.

Downgrade. The attacker forces a connection to a weaker, older protocol so the attacker can break it. TLS downgrade is the classic example. Indicator: TLS 1.0 or SSL 3.0 events in logs that should be TLS 1.2 or 1.3.
Collision (hash collision). Two different inputs produce the same hash. Breaks integrity assumptions and signature schemes. MD5 and SHA-1 are no longer collision resistant.
Birthday. A statistical attack that finds collisions faster than brute force expects. Named after the birthday paradox in probability: in a room of 23 people, two share a birthday roughly half the time. Birthday attacks shorten the brute-force search for collisions.

Password attacks

Password attacks come in two main shapes on this exam. The exam likes to test you on the indicator pattern, not just the definition.

Attack	Definition	Indicator pattern
Password spraying	Small list of common passwords (Spring2026!, Welcome1) tried against a large list of accounts	Wide and shallow. Many accounts touched, few lockouts. Often timed to avoid lockout thresholds
Brute force	Many passwords tried against one account or many accounts until something works	Narrow and deep. Lockouts pile up on one or a few accounts

Multi-factor authentication (MFA) defeats most password attacks. Spraying targets accounts that lack MFA. Brute force against an account with MFA is wasted effort if the second factor holds.

The indicators

These are the indicators listed in the SY0-701 objective. Each one is a piece of evidence in a log, alert, or system that points at a specific kind of attack. Memorize the mapping.

Indicator	What it looks like	Most common attack category
Account lockout	Many failed logins on one account that crosses the lockout threshold	Password attack (brute force)
Concurrent session usage	Same account signed in from two devices at the same time	Account takeover or shared credentials
Blocked content	Proxy or EDR blocked a download or a script	Malware delivery attempt
Impossible travel	Sign-ins from two locations too far apart for the same human	Account takeover (often follows credential phishing)
Resource consumption	CPU, memory, disk, or bandwidth spike	Malware (ransomware encryption, worm scanning, cryptojacking)
Resource inaccessibility	A system or app is unavailable for legitimate users	DDoS or ransomware
Out-of-cycle logging	Log activity at a time when the system should be quiet	Attacker lateral movement, after-hours exfiltration
Published / documented	Alert matches a public IOC (Indicator of Compromise) from CISA or a vendor	Any known campaign matching that IOC
Missing logs	A gap in the log timeline	Defense evasion (attacker clearing logs) or broken logging

MITRE ATT&CK as working vocabulary

MITRE ATT&CK is a public catalog of attacker tactics, techniques, and procedures (TTPs). Every modern SOC uses ATT&CK as the shared vocabulary for attacker behavior. A Tier 1 analyst does not need to memorize technique IDs. The analyst does need to recognize the tactic names so they can speak the same language as Tier 2 and the incident responder on the next handoff.

The high-level tactics: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact. Each tactic has many techniques and sub-techniques under it. Real incidents stitch together a sequence of techniques. The ransomware case in this lesson's Assignment 2 follows Initial Access (a phishing payload), Execution (the user runs it), Defense Evasion (process hides as svchost.exe.bak), Credential Access (the contractor's reused svc_backup creds), Lateral Movement (SMB to the file server), and Impact (T1486 Data Encrypted for Impact, plus shadow copy deletion).

Common gotchas

Two passwords is not MFA. Two factors from the same category (something you know) does not count. MFA requires factors from at least two different categories.
Wide and shallow failed logins is spraying, not brute force. The exam likes to see if you can spot the pattern. Many accounts touched, few lockouts, repeated small list of passwords. That is spraying. Lockouts piled up on one account is brute force.
Concurrent sessions is not always an attack. Some users legitimately sign in from a laptop and a phone at the same time. Confirm device registration before raising the alarm.
Missing logs is never harmless. Either logging broke silently or an attacker cleared entries. Both need investigation.
On-path attack is the current term. Man-in-the-middle is the old term. SY0-701 uses on-path.
Bloatware is more than annoying. Pre-installed vendor software has shipped vulnerable libraries before. Treat bloatware as a real risk, not a UX complaint.
Directory traversal is the URL with `../` in it. Recognize the pattern in log snippets. URL encoding like %2e%2e%2f is the same thing.
CSRF tricks the browser. SSRF tricks the server. The acronym is one letter different. The blast radius is very different. SSRF can reach internal services that the attacker could not reach directly.
Downgrade attack indicator is the version of the protocol in the log. TLS 1.0 events on a system that should be TLS 1.2+ are a red flag.
Resource inaccessibility is an availability issue. It maps to the A in CIA. The triage path is different from confidentiality or integrity issues.

Real-world context

In a SOC Tier 1 analyst seat, the morning queue is a wall of indicators. The analyst opens the SIEM (Security Information and Event Management) dashboard, sorts by severity, and triages by pattern. The first question is which category, not which tool. The second question is which specific attack within that category. The third question is what the next step is: contain, investigate, or escalate.

A typical morning at a fictional regional credit union (use Beacon Financial Partners from this lesson's assignments as the running example). Friday at 16:42 the proxy blocked a download named invoice_overdue_pdf.exe from a workstation in the Schaumburg branch. Blocked content alert. The on-shift Friday analyst tagged it as malware delivery attempt and closed the ticket. Saturday at 09:18 an impossible travel alert fired on an unrelated user. The Saturday analyst tagged it as account takeover and triggered an automatic conditional-access block. Sunday at 03:14 the SIEM correlation rule for "high-rate file rename and crypto-extension write" fired on FILESRV-04, also in Schaumburg. The Sunday analyst named it ransomware (the strongest fit for the indicators), saw the missing log gap from 04:08 to 04:17 on the file server (defense evasion, T1070 Indicator Removal), and escalated to Tier 2.

Monday at 06:45 the Tier 1 analyst on shift opens the queue and sees all three tickets, the Friday block, the Saturday impossible travel, and the Sunday ransomware. The mistake the inexperienced analyst makes is to treat them as three separate incidents. The experienced analyst pulls the timeline and sees one chain. The Friday phishing payload was likely delivered to a second workstation that the proxy missed. The Saturday impossible travel was the captured credentials being tested. The Sunday ransomware was the payoff. One incident. Three days. Three chances to catch it earlier.

Sample alert walkthrough using the SOC five-step triage habit. The SIEM fires "Impossible travel: user signed in from Chicago at 09:12 and from Lagos at 09:18." Step 1, category: network or credential attack (account takeover). Step 2, specific attack: most likely a credential replay using credentials captured in a prior phishing or spraying campaign. Step 3, supporting indicators: check for blocked content on this user's workstation in the last 72 hours, check for concurrent session usage, check for any out-of-cycle logging on hosts this user touches. Step 4, action: trigger the conditional-access policy to block the Lagos session, force a password reset, require MFA re-enrollment. Step 5, related: check the IOC feeds for the Lagos IP and the user agent in the sign-in log. A working analyst runs this in under five minutes.

Sources

CompTIA Security+ SY0-701 Exam Objectives, Section 2.4
MITRE ATT&CK Enterprise Matrix (attack.mitre.org)
CISA Known Exploited Vulnerabilities catalog (cisa.gov/known-exploited-vulnerabilities-catalog)
NIST SP 800-61r2, Computer Security Incident Handling Guide
NIST SP 800-83, Guide to Malware Incident Prevention and Handling
NIST SP 800-94, Guide to Intrusion Detection and Prevention Systems (IDPS)