Security Operations · Topic 3 of 10

Indicators of Malicious Activity

Recognise signs of malicious activity across network, host, application, cloud and identity data, from beaconing to impossible travel, as tested in CySA+.

6 min

In a nutshell

An IOC is evidence of possible compromise, and context decides whether it is malicious.
A baseline of normal activity is needed to recognise anomalies.
Beaconing means regular, repeating outbound connections to one destination.

What it is

An indicator of compromise (IOC) is a piece of evidence that suggests a system may have been attacked or breached. Examples are a file hash, an internet protocol (IP) address, a domain name or an unusual behaviour in the logs.

Indicators rarely prove an attack alone. The analyst's job is to collect them from several places, judge how likely they are to be malicious, and decide what to do next.

How it works

An indicator only means something when compared with a baseline, which is a record of normal behaviour. A large upload at night is suspicious for an office laptop and ordinary for a backup server.

Network indicators

Indicator	What it looks like	Possible meaning
Beaconing	Small connections at regular intervals to one external host	Malware checking in with a command and control (C2) server
Unusual Domain Name System (DNS) traffic	Very long or random looking names, many failed lookups	Domain generation algorithm or data hidden in DNS queries
Traffic spike	Sudden jump in volume	Denial of service, or data exfiltration (theft of data)
Odd ports or protocols	Common services on strange ports	Evasion or a backdoor
Scanning	One host probing many addresses or ports	Reconnaissance
Rogue device	Unknown media access control (MAC) address on the network	Unauthorised equipment

Host indicators

Unexpected processes or services, especially with odd names, or a known program started from an unusual folder or by an unusual parent process.
New scheduled tasks, startup entries or registry changes, which are common ways to stay on a system (persistence).
Unauthorised software or disabled security tools.
Unusual file changes, such as many files renamed or encrypted in a short time, which is typical of ransomware.
High processor or memory use with no business reason, which can point to cryptomining.
New local accounts or sudden privilege changes.

Identity indicators

Pattern	Meaning
Many failures on one account	Password guessing against that user
One password tried on many accounts	Password spraying, designed to avoid lockouts
Leaked credentials tried on many sites	Credential stuffing
Repeated multifactor authentication (MFA) prompts the user did not start	Push fatigue, where the user is pressured into approving
Logins from two distant places within a short time	Impossible travel
Normal user suddenly using admin rights	Privilege escalation

Application and cloud indicators

In web server logs, look for requests carrying strange characters or code fragments aimed at forms and parameters, a burst of error responses, or an unfamiliar file appearing in a web folder (a possible web shell). In cloud logs, look for new access keys, changes to security groups, application programming interface (API) calls from unfamiliar regions, public storage buckets and sudden creation of many virtual machines.

Email and user behaviour

Phishing emails show mismatched sender and reply addresses, urgent language, look alike domains and unexpected attachments or links. User and entity behaviour analytics (UEBA) tools learn a baseline per account and flag deviations, such as a person who suddenly downloads a large number of files.

URL shorteners

A URL shortener turns a long address into a short link that redirects. Attackers use them in email, text messages and social posts to hide the real destination and to slip past filters that judge the visible domain.

Expand a short link without clicking it. Use the shortener's preview feature, a URL expander or a reputation lookup, or open it only in a sandbox or isolated browser.

From a command line, curl -sI https://short.example/abc prints the response headers, and the Location: header shows where the link redirects. A link that goes through several redirects before landing is more suspicious.

Business email compromise (BEC)

Business email compromise (BEC) is fraud by email, usually with no malware or malicious link, so technical filters often miss it. Common forms are:

Executive impersonation: a message that seems to come from a senior person and asks for an urgent payment or gift cards.
Invoice or payment redirection: a real supplier's bank details are changed to the attacker's account.
Compromised mailbox: the attacker uses a genuine account and may add hidden inbox rules that forward or delete messages.

Indicators are a Reply-To address that differs from the sender, a look alike domain, urgency with a request for secrecy, changed bank details, and a new external forwarding rule in the mailbox audit log. Checks are an out of band callback to a known phone number, dual approval for payments, and a quick report to the bank if money has already moved.

From indicator to verdict

10:02:11 host-22 -> 203.0.113.80:443  bytes_out=412
10:07:11 host-22 -> 203.0.113.80:443  bytes_out=412
10:12:11 host-22 -> 203.0.113.80:443  bytes_out=412

Same destination, same size, a five minute interval: this is the classic shape of beaconing. The analyst would check the destination against threat intelligence, then look at the process on host-22 that opened the connections.

What to remember for the exam

An IOC is evidence of possible compromise, and context decides whether it is malicious.
A baseline of normal activity is needed to recognise anomalies.
Beaconing means regular, repeating outbound connections to one destination.
Password spraying is one password on many accounts, and credential stuffing reuses leaked pairs.
Impossible travel and repeated unsolicited MFA prompts are identity red flags.
New scheduled tasks, services or registry run entries often mean persistence.
Odd DNS patterns can reveal command and control or data theft.
Mass file renaming or encryption points to ransomware.
Always correlate several sources before declaring an incident.

Exam tip

When two answers both describe a login problem, count the accounts and the passwords. Many accounts with few passwords is spraying, and one account with many passwords is a brute force attempt.

Common mistakes

Treating every anomaly as an attack. Backups, updates and new projects cause unusual traffic too, so check the business context first.

Using one data source. A single log line may be explained innocently, while the same event seen on the endpoint, the network and the identity system is much stronger.

Ignoring low and slow activity. Attackers who spread attempts over days avoid simple thresholds, so look at trends as well as bursts.

Forgetting outbound traffic. Many teams watch what comes in, but beaconing and exfiltration show up in what goes out.

Confusing an indicator with an attack technique. An IOC is an artefact you can observe, while a technique describes the attacker's method.

Check yourself

What does beaconing look like in network logs?
Small, regular connections from an internal host to the same external address at fixed intervals.
How does password spraying differ from brute force?
Spraying tries one or a few passwords across many accounts, while brute force tries many passwords against one account.
Why is a baseline needed?
Without knowing normal behaviour, the analyst cannot tell an anomaly from routine activity.

Topic 3 of 10 in Security Operations

Test yourself on Security Operations

The full CompTIA CySA+ CS0-004 question bank has 654 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.