Threats, Vulnerabilities, and Attacks · Topic 7 of 10
Malware Attacks and Indicators of Compromise
Identify Security+ malware such as ransomware, worms, rootkits and fileless malware, and read indicators like hashes, timestamps and impossible travel.
- 5 min
- A virus needs a host file and user action. A worm spreads by itself.
- A trojan pretends to be legitimate software. Adware shows unwanted ads.
- Ransomware encrypts data for payment. Offline backups are the key recovery control.
What it is
Malware is software built to harm a system, steal data or give an attacker control. An indicator of compromise (IOC) is a piece of evidence that suggests a system has been attacked, such as a known bad file hash or a login from an impossible location.
The exam gives a short scenario and asks you to name the malware or to read the indicators. Learn how each kind behaves and what traces it leaves.
How it works
Malware types
| Type | Key feature |
|---|---|
| Virus | Attaches to a file or program and needs user action to spread |
| Worm | Spreads on its own across networks without user action |
| Trojan | Looks like useful software but carries a hidden harmful function |
| Ransomware | Encrypts data or locks a system and demands payment |
| Spyware | Secretly watches activity and sends information away |
| Adware | Shows unwanted advertising, often bundled with free software, and may track browsing |
| Keylogger | Records keystrokes to capture passwords and messages |
| Rootkit | Hides deep in the operating system, firmware or kernel to keep access and avoid detection |
| Logic bomb | Stays dormant until a condition, such as a date or an event, triggers it |
| Fileless malware | Runs in memory using legitimate tools such as scripting engines, leaving little or nothing on disk |
A virus needs a person to run an infected file. A worm needs no one, which is why worms can spread through a network very quickly.
Ransomware, rootkits and fileless malware
Ransomware commonly encrypts files, and many groups also steal data first and threaten to publish it. Paying does not guarantee the data is returned, so offline or immutable backups are the most reliable way to recover.
A rootkit controls parts of the system that reporting tools depend on, so normal tools may not show it. Booting from trusted media or reinstalling is often the safe way to clean such a system.
Fileless malware avoids file scanning because there is no file to scan. Memory analysis, script logging and behavior based endpoint detection are the controls that find it.
Indicators of compromise
| Indicator | What it shows |
|---|---|
| Hash | The fingerprint of a known malicious file, matched against threat feeds |
| Internet Protocol (IP) address | Traffic to or from an address known for attacks or command and control |
| Domain | Lookups or connections to a known bad or newly registered domain |
| Malicious processes | Unknown programs, or normal ones running from odd locations or with odd parents |
| File system artifacts | New, renamed or encrypted files, dropped tools, ransom notes |
| Timestamp | File or log times that do not fit, such as changes at 3 a.m. or altered file dates |
| Log manipulation | Logs cleared, edited or missing for a period, often to hide activity |
| Excessive resource consumption | Unusual processor, memory, disk or network use, as with a cryptominer or data theft |
| Plaintext strings | Readable text inside a file or memory, such as an attacker's address or commands |
| Account lockout | Repeated failed logins, possibly guessing or spraying |
| Impossible travel | Logins from places too far apart for one person to travel between in the time |
| Concurrent sessions | One account in use from two places at once |
Reading indicators together
Several indicators together are far stronger evidence than one alone. A single failed login is normal, but a burst of failures followed by a success from a new location deserves attention.
| Scenario | Likely cause |
|---|---|
| Files renamed with a new extension and a note demanding payment | Ransomware |
| Fans at full speed, high processor use, connections to a mining pool | Cryptominer |
| Security log cleared just after an administrator login at night | Attacker covering tracks |
| No malicious file on disk, but a script engine making outbound connections | Fileless malware |
| Strange behavior begins on a set date after a staff member leaves | Logic bomb |
Defending against malware
Endpoint protection, patching, email filtering and application control block or limit most malware. Least privilege limits what a malicious program can do once it runs, and backups limit the damage of ransomware.
What to remember for the exam
- A virus needs a host file and user action. A worm spreads by itself.
- A trojan pretends to be legitimate software. Adware shows unwanted ads.
- Ransomware encrypts data for payment. Offline backups are the key recovery control.
- A rootkit hides itself and is hard to find from within the infected system.
- Fileless malware lives in memory and uses legitimate tools.
- A logic bomb runs when a set condition is met.
- Hashes, IP addresses and domains are the IOCs most often shared in threat feeds.
- Log manipulation, odd timestamps, impossible travel and concurrent sessions point to compromise.
When the question says "no user interaction" and "spreads across the network", think worm. When it says "nothing written to disk", think fileless malware.
Common mistakes
Calling any malware a virus. Virus is one specific type. The question usually gives a spreading behavior to separate it from a worm or trojan.
Thinking a logic bomb only waits for a date. It can wait for any condition, such as an account being deleted.
Reading one indicator as proof. A lockout may simply be a forgotten password. Combine indicators before declaring an incident.
Overlooking missing logs. Silence in a log is itself a warning sign, since attackers often clear traces.
Relying only on file hashes. Fileless malware and slightly changed files have no matching hash.
Backups connected to the network can be encrypted by ransomware too. Keep at least one copy offline or immutable.
Check yourself
How does a worm differ from a virus?
A worm spreads by itself across a network, while a virus needs user action to run an infected file.
Why can fileless malware avoid traditional antivirus?
It runs in memory using legitimate tools and leaves no malicious file on disk to scan.
What does impossible travel indicate?
Logins from places too far apart for one person to reach in the time, which suggests stolen credentials.
Topic 7 of 10 in Threats, Vulnerabilities, and Attacks
Test yourself on Threats, Vulnerabilities, and Attacks
The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.