Malicious Activity Indicators for Security+

This Security+ topic covers observable clues that suggest malicious activity may be occurring or has occurred. It teaches how to analyze symptoms, telemetry, user reports, system behavior, access patterns, service behavior, and attack-specific clues.

Start first lesson

5 lessons in this topic

Malware Attack Indicators

Recognize likely indicators of ransomware, Trojans, worms, spyware, viruses, keyloggers, logic bombs, rootkits, and related malware.

Physical Attack Indicators

Identify indicators of physical attacks such as brute force, RFID cloning, and environmental tampering.

Network Attack Indicators

Analyze signs of DDoS, DNS attacks, wireless attacks, on-path attacks, credential replay, and malicious code moving through networks.

Application Attack Indicators

Recognize application-layer signs of injection, buffer overflow, replay, privilege escalation, forgery, and directory traversal.

Credential And Cryptographic Attack Indicators

Identify suspicious patterns tied to password attacks, credential misuse, certificate problems, and cryptographic compromise indicators.

Common mistakes to avoid

Learners often confuse worms and viruses. A worm self-propagates across systems or networks. A virus attaches to a host file or program and spreads when that host runs.

Learners often choose the control that failed instead of the indicator. A badge reader, lock, camera, or sensor is a control. The indicator is the suspicious evidence: cloned badge behavior, forced-entry marks, abnormal environment, or tampering.

Learners often choose the mitigation instead of the indicator. Rate limiting, filtering, segmentation, secure DNS, VPNs, and monitoring are controls.

Learners often answer with the vulnerability class when the question asks for observed activity. That can be acceptable when the answer choices are attack indicators, but explanations should stay evidence-focused: suspicious input, crashes, repeated requests,...