2.4 Given a scenario, analyze indicators of malicious activity

★ Starred in your notes: Cyber Kill Chain (order + keywords) · ARP poisoning / on-path (adversary-in-the-middle) · rogue AP · evil twin · bluejacking · zero-day.

Breakdown 1 — Malware attacks

Malware	Defining trait (class wording in italics)
Virus	Requires human interaction (open the file) to spread; attaches to files. Variants: polymorphic, cavity/file-infector, boot sector
Worm	No human interaction — self-propagates over the network
Trojan	Pretends to be legitimate software; RAT = remote access Trojan
Ransomware	Encrypts data and demands payment; often paired with exfiltration ("double extortion")
Spyware	Secretly collects user data/activity
Keylogger	Records keystrokes (hardware or software)
Bloatware	Unwanted pre-installed software; expands the attack surface
Logic bomb	Time-based or condition-based trigger (fires on a date or when an employee is removed from payroll)
Rootkit	Allows you to hide stuff from running view — kernel/OS-level, hides processes/files; hard to detect from inside the OS

From class — malware payloads: backdoor (netcat — "the Swiss Army knife"), command and control (C2), ransomware. How malware hides: polymorphic (changes its code/signature), stealth, fileless (lives in memory/PowerShell, no file on disk), rootkit. Tools mentioned: VirusTotal (check a file hash).

Breakdown 2 — Physical attacks

• Brute force — physically forcing entry (cutting locks, breaking doors).
• RFID cloning — copying a badge/card signal to make a duplicate.
• Environmental — attacking HVAC, power, water to cause outages.

Breakdown 3 — Network attacks

Attack	What it looks like	Class notes
DDoS — amplified	Small request → huge response reflected at the victim (DNS, NTP, memcached amplification)	Smurf attack = ICMP echo to a broadcast address with the victim's spoofed source
DDoS — reflected	Attacker spoofs the victim's IP so third parties reply to the victim
DoS classics	Ping of death (oversize packet), ping flood ("simple DoS"), botnets, malformed packets, resource exhaustion, deliberate misuse
DNS attacks	DNS poisoning/spoofing (fake record in cache → pharming), DNS tunneling, domain hijacking	Cache → hosts file → DNS server is the lookup order; a poisoned entry means "mario's IP would be different"
Wireless	Rogue AP (unauthorized AP/hotspot), evil twin (look-alike SSID to steal credentials), jamming, deauthentication attack (forces clients off so they reconnect through you / to capture handshakes)
On-path (man-in-the-middle / adversary-in-the-middle)	Attacker sits between two parties: ARP poisoning (victim's MAC ↔ IP mapping replaced — defend with DAI, dynamic ARP inspection), MAC spoofing, SSL stripping (downgrade HTTPS→HTTP), session hijacking, replay	arp -a shows the ARP table; MAC = 48 bits (first 24 = OUI/vendor)
Credential replay	Captured authentication data re-sent (pass-the-hash, session token replay)
Malicious code	Scripts/macros delivered over the network
VLAN hopping (class)	Double-tagging or switch-spoofing to reach another VLAN via a trunk
MAC flooding (class, Day 5)	Overflow the switch CAM table so it floods frames like a hub → attacker can sniff	Port security / flood guard
Bluetooth (class)	Bluejacking = unsolicited messages; Bluesnarfing = theft of information; Bluesmacking = Bluetooth DoS

From class — recon indicators: Xmas scan — nmap scan against non-Windows hosts that sets the FIN, URG, PSH flags ("FUP"). TCP flags: SYN = first packet out, ACK = acknowledges, PSH = push (like a queue), URG = process first, FIN = last packet/hang up, RST = disconnect/abort. Banner grabbing = the service banner tells you what the device runs. Half-open (SYN) scan = nmap -sS — sends SYN, gets SYN/ACK, never completes the handshake (stealthier); scanning without authorization can be illegal. Fuzzing = throwing random data at a service to see how it reacts. Promiscuous mode = the NIC sees all traffic, not just its own.

Breakdown 4 — Application, cryptographic, and password attacks

Category	Attack	Note
Application	Injection (SQL/command/LDAP), buffer overflow, replay, privilege escalation, forgery (CSRF/SSRF), directory traversal	See 2.3
Cryptographic	Downgrade (force weaker protocol — SSL stripping, POODLE), collision (two inputs, same hash), birthday (probability math that makes collisions easier than expected — "same hash attack")	MD5/SHA-1 are collision-broken
Password	Spraying (one password against many accounts — avoids lockout), brute force (all combinations), dictionary, hybrid (dictionary + numbers and symbols), rainbow table (precompiled hashes; defeated by salt), credential stuffing (reuse leaked user/pass pairs on other sites), pass-the-hash	Salt + key stretching defend stored passwords

Breakdown 5 — Indicators (what you see in the logs)

Indicator	Meaning
Account lockout	Brute force/spraying in progress
Concurrent session usage	Same account logged in from two places
Blocked content	Security tool stopped something — investigate what tried
Impossible travel	Login from two distant locations within an impossible time — class: could also be legitimate VPN usage; verify
Resource consumption	CPU/disk/network spike — cryptomining, DoS, exfiltration
Resource inaccessibility	Files/services unavailable — ransomware, DoS
Out-of-cycle logging	Logs/events at unusual times or unexpected log rotation
Published/documented	Your data shows up on paste sites/dark web
Missing logs	Attacker cleared them

Breakdown 6 — Attack frameworks (class emphasized: know the order)

Cyber Kill Chain (Lockheed Martin): 1 Reconnaissance (search/research the target) → 2 Weaponization (create the exploit/payload) → 3 Delivery (send it: email, USB, web) → 4 Exploitation (trigger the vulnerability) → 5 Installation (malware/backdoor installed) → 6 Command & Control (communicate with the implant) → 7 Actions on Objectives (the goal — exfiltrate, destroy; last step). Keywords: search → create → send → exploit → install → communicate → act.

• Diamond Model of intrusion analysis — four vertices: Adversary, Infrastructure, Capability, Victim.
• MITRE ATT&CK — matrix of tactics/techniques used post-compromise.

Quick self-check

• Worm vs. virus? (Worm needs no human action.)
• Which attack uses one password across many accounts? (Spraying.)
• What flags does an Xmas scan set? (FIN, URG, PSH.)
• Which kill-chain phase is C2? (6th — after installation, before actions on objectives.)
• Bluejacking vs. bluesnarfing? (Send messages vs. steal data.)