SkarpChapter 8 of 25
Indicators of Malicious Activity and Basic Detection Logic
Peek over the shoulder of a SOC analyst as you interpret indicators of malicious activity in logs, alerts, and user behavior to distinguish real incidents from noise.
Seeing Like a SOC Analyst: What Counts as Malicious?
SOC Analyst Mindset
You will practice looking at logs and alerts the way a SOC analyst does: scanning for signs that something is wrong, not just reacting to every noisy alert.
Where This Fits in Security+
This content lives mainly in Security Operations, but connects to Threats, Vulnerabilities, and Mitigations and Security Architecture because detection depends on how systems are built.
Key Definitions
- Indicator of malicious activity: any observable data point suggesting hostile or abnormal behavior.
- IoC: evidence a system has likely already been compromised.
- IoA: evidence an attack is being attempted or is in progress.
Why the Distinction Matters
For the exam, remember: IoAs focus on attacker behavior and intent now; IoCs focus on proof that the attacker already has a foothold or caused damage.
Indicators of Compromise vs Indicators of Attack
What Are IoCs?
Indicators of Compromise are signs that a system has likely already been breached: malicious files, backdoors, rogue accounts, or data exfiltration evidence.
Examples of IoCs
- Malicious file hashes on endpoints
- Malware binaries on disk
- Unauthorized accounts
- Persistence entries
- Confirmed C2 connections
What Are IoAs?
Indicators of Attack are behavioral clues that an attack is underway: repeated login failures, scanning, odd PowerShell use, or rapid access attempts.
Exam Tip: Wording Clues
If the scenario shows proven malware or data theft, think IoC. If it shows suspicious attempts without confirmed breach, think IoA.
Common Indicators of Malicious Activity in Logs and Alerts
Pieces of the Puzzle
Analysts see small pieces: log lines, alerts, and performance metrics. Your job is to spot which pieces might indicate malicious activity.
Blocked or Flagged Content
Web proxies, email gateways, and firewalls that block malicious domains or attachments generate alerts that can signal attempted phishing or malware delivery.
Auth and Network Anomalies
Watch for unusual logins, failed attempts, odd hours, spikes in outbound traffic, or new lateral connections between hosts that normally never talk.
Endpoint Anomalies and Correlation
New suspicious processes, disabled security tools, and correlated alerts across multiple systems are strong signs of malicious activity.
Impossible Travel and Anomalous User Behavior
What Is Impossible Travel?
Impossible travel is when the same account logs in from locations so far apart, in such a short time, that no human could physically move between them.
How It Is Detected
Tools use geo-IP, time between logins, and a user’s normal patterns (home country, work hours, devices) to flag suspicious access.
Other Anomalous Behaviors
Watch for odd data access, privilege misuse, and sudden use of admin tools or PowerShell by users who normally never touch them.
Link to IoAs and IoCs
These patterns usually indicate an attack in progress (IoA). If you also see changed MFA or data theft, those are Indicators of Compromise.
Resource Consumption, Performance Spikes, and Missing Logs
Why Resources Matter
Attackers change how systems use CPU, memory, and bandwidth. Sudden spikes or unusual patterns can be early hints of compromise.
Examples of Resource Anomalies
Cryptomining can peg CPU/GPU; data exfiltration causes long outbound bandwidth spikes; botnets can drive high outbound traffic.
Missing or Tampered Logs
Gaps in logs, disabled logging, or SIEM feed interruptions from key systems are strong signs someone may be hiding their tracks.
Exam Angle
If a scenario shows logging disabled on a critical server after suspicious activity, treat it as likely compromise and escalate.
Mini Log Lab: Classifying Indicators (IoA vs IoC)
How to Use These Snippets
Treat each mini log snippet like a SOC alert. Decide whether it shows an Indicator of Attack, an Indicator of Compromise, or both.
Snippet 1: Login Pattern
Multiple failures then success, followed by another success from a new IP, point to password guessing or account misuse: mostly an IoA.
Snippet 2: Cryptominer
A miner.exe process with high CPU and mining pool connections is strong proof of compromise: this is clearly an IoC.
Snippet 3: Impossible Travel
Logins from New York and Berlin within 20 minutes suggest credential misuse: an IoA. Later data theft would add IoCs.
Basic Detection Logic: How SIEM, EDR/XDR, and Logs Work Together
Why Tools Matter for Detection
You interpret indicators through tools: SIEM for centralized logs, EDR/XDR for endpoints and more, and native logs for detailed evidence.
Role of the SIEM
A SIEM collects logs from many systems, applies correlation rules, and raises alerts. It is primarily a detective technical control.
Role of EDR/XDR
EDR/XDR monitors processes, files, and network behavior on endpoints and beyond, spotting IoAs and IoCs and sometimes auto-isolating hosts.
Logs Across a Hybrid Environment
OS, app, and cloud audit logs provide raw evidence. In a hybrid environment, SIEM or XDR helps unify and correlate them.
Triage and Escalation Basics: From Alert to Incident
Why Triage Matters
Not every alert is a breach. Triage is how analysts decide what is noise, what is suspicious, and what is a real incident.
Simple Triage Flow
1) Receive alert, 2) Validate it, 3) Classify as IoA/IoC, 4) Assess impact and scope, 5) Choose an action based on severity.
Impact and CIA
Assess whether confidentiality, integrity, or availability is at risk. High-value assets and clear IoCs justify escalation.
Exam Trap: Overreaction
Security+ often expects you to verify and gather evidence before taking drastic steps like shutting down servers.
Thought Exercise: Escalate or Monitor?
Work through these short scenarios. For each, decide:
- A. Monitor only (document, maybe tune alerts)
- B. Investigate further (gather more data, but not yet a full incident)
- C. Escalate as incident (IoCs present or high risk)
Then compare with the suggested reasoning.
Scenario 1: Odd working hours
- A developer normally works 09:00–17:00 local time.
- You see a successful VPN login at 23:30 from the same city, same device fingerprint, MFA passed.
Suggested answer: B. Investigate further.
- Reasoning: Single late-night login could be legitimate overtime. But it is outside normal behavior. Check with the manager or user, review recent activity (file access, admin actions). Not yet an incident.
Scenario 2: Disabled EDR agent
- EDR console shows agent on a finance server went offline 5 minutes after a suspicious PowerShell script alert.
- No maintenance window is scheduled.
Suggested answer: C. Escalate as incident.
- Reasoning: Suspicious script + sudden loss of telemetry on a sensitive server is a strong IoC cluster. Treat as likely compromise, follow incident response.
Scenario 3: Web scan from internal host
- IDS detects a host scanning your public web server with many different URLs.
- Asset inventory shows the IP belongs to the security team’s vulnerability scanner, running a scheduled scan.
Suggested answer: A. Monitor only.
- Reasoning: This is expected behavior from an approved scanner. Document and, if needed, tune IDS to reduce noise.
As you practice Security+ questions, mentally run this A/B/C classification to decide the best next step.
Check Understanding: Indicators and Tools
Answer this question to solidify your understanding of indicators and detection tools.
A SOC analyst sees the following: 1) A spike in failed logins to several user accounts from the same external IP 2) No successful logins yet from that IP 3) The firewall and IDS both flag the IP as potentially malicious Which of the following best describes the situation and the most appropriate immediate action?
- It is primarily an Indicator of Compromise; immediately reimage all affected user machines.
- It is primarily an Indicator of Attack; block the source IP at the firewall and continue monitoring authentication logs.
- It is normal user behavior; tune out the alerts as false positives.
- It is a logging configuration issue; increase log verbosity on the authentication system.
Show Answer
Answer: B) It is primarily an Indicator of Attack; block the source IP at the firewall and continue monitoring authentication logs.
Multiple failed logins from one external IP with no successful logins yet describe an ongoing attack attempt (IoA), such as password spraying. The best immediate action is to block the source IP at the firewall (or similar control) and keep monitoring/authentication logs. There is no evidence yet of compromise (no successful breach), so reimaging endpoints is premature. Calling it normal behavior or just a logging issue ignores clear attack indicators.
Check Understanding: Impossible Travel and Missing Logs
Test yourself on anomalous behavior and logging indicators.
An analyst reviews an impossible travel alert for a privileged admin account. The SIEM shows: - Login from Country A at 09:00 - Login from Country B at 09:20 (impossible travel) - Immediately after the second login, audit logging on a critical database server is disabled Which statement is MOST accurate?
- The impossible travel is an Indicator of Compromise, and the disabled logging is an Indicator of Attack.
- Both events are false positives because admins often travel and change logging settings.
- The impossible travel is an Indicator of Attack, and the disabled logging is an Indicator of Compromise that warrants escalation.
- These events only indicate a misconfigured SIEM correlation rule and do not require action.
Show Answer
Answer: C) The impossible travel is an Indicator of Attack, and the disabled logging is an Indicator of Compromise that warrants escalation.
Impossible travel is typically an Indicator of Attack (suggesting credential misuse). Disabling audit logging on a critical server immediately afterward is strong evidence the attacker is covering their tracks, which is an Indicator of Compromise. Together, they clearly justify escalation under the incident response process.
Key Term Review: Indicators and Detection
Flip through these cards to reinforce core concepts.
- Indicator of malicious activity
- Any observable data point (log entry, alert, behavior, metric) suggesting hostile or abnormal activity that may be part of an attack.
- Indicator of Compromise (IoC)
- Evidence that a system has likely already been compromised, such as malware present, unauthorized accounts, persistence mechanisms, or confirmed data exfiltration.
- Indicator of Attack (IoA)
- Evidence that an attack is being attempted or is in progress, focused on attacker behavior (for example: scanning, repeated login failures, impossible travel) even if compromise is not yet confirmed.
- Impossible travel
- A detection pattern where the same account logs in from geographically distant locations within a time period too short for physical travel, suggesting credential misuse.
- Unusual resource consumption
- Abnormal CPU, memory, disk, or bandwidth usage (for example: cryptomining, data exfiltration, DDoS participation) that can indicate malicious activity.
- Missing or tampered logs
- Gaps in log data, disabled logging, or altered log settings that may indicate an attacker is attempting to hide their actions.
- SIEM (Security Information and Event Management)
- A system that collects and correlates logs and security events from multiple sources to detect, alert on, and help investigate potential security incidents.
- EDR/XDR
- Endpoint Detection and Response / Extended Detection and Response tools that monitor endpoints (and in XDR, additional domains) for malicious behavior, often enabling automated containment.
- Triage
- The process of quickly evaluating alerts to determine validity, severity, and priority, deciding whether to monitor, investigate, or escalate as an incident.
- Escalation
- Handing off or raising the handling of a suspected security event to a higher level (for example: incident response team) when indicators and impact justify treating it as an incident.
Key Terms
- EDR
- Endpoint Detection and Response; security tooling that monitors endpoints for malicious activity and enables investigation and response.
- XDR
- Extended Detection and Response; an evolution of EDR that extends detection and response across endpoints, networks, cloud, and other domains.
- SIEM
- Security Information and Event Management; a system that collects and correlates logs and security events from multiple sources to detect and investigate potential incidents.
- Triage
- The process of evaluating and prioritizing alerts based on validity, severity, and impact to decide on monitoring, investigation, or escalation.
- Escalation
- Raising the handling of a suspected security event to a higher level, such as an incident response team, when indicators and impact justify treating it as an incident.
- Impossible travel
- A detection pattern where the same account logs in from geographically distant locations within a time period too short for physical travel, suggesting credential misuse.
- Indicator of Attack (IoA)
- Evidence that an attack is being attempted or is in progress, focused on attacker behavior even if compromise is not yet confirmed.
- Indicator of Compromise (IoC)
- Evidence that a system has likely already been compromised, such as malware present, unauthorized accounts, persistence mechanisms, or confirmed data exfiltration.
- Indicator of malicious activity
- Any observable data point (log entry, alert, behavior, metric) suggesting hostile or abnormal activity that may be part of an attack.
- User behavior analytics (UBA/UEBA)
- Techniques and tools that model normal user and entity behavior and flag deviations that may indicate malicious activity.