Forensic Science · Topic 1 of 9
Cybercrime, Attribution and Indicators of Compromise
Learn the types of computer crime, their impact, attribution, investigation challenges, indicators of compromise and the signs of a web attack.
- 5 min
- A computer can be the target, the tool or an incidental holder of evidence.
- Attribution combines technical and contextual evidence and is expressed as confidence.
- IoCs are evidence of a past or ongoing breach, such as bad hashes, domains and addresses.
What it is
A computer crime is an illegal act in which a computer or network is the target, the tool or the place where evidence is found. Cybercrime investigation is the process of finding out what happened, who did it and how to prove it in a way a court will accept.
This page covers the crime types, what they cost an organization, how an actor is attributed, the traces left behind (indicators of compromise) and the signs of a web attack.
How it works
Types of computer crimes
| Category | Meaning | Examples |
|---|---|---|
| Computer as target | The system itself is attacked | Hacking, malware, denial of service, ransomware |
| Computer as tool | The computer helps commit a traditional crime | Fraud, phishing, identity theft, online harassment |
| Computer as incidental | The computer only holds evidence | Records of a drug dealer, a suspect's chat history |
Impact at the organizational level
Cybercrime affects an organization in several ways:
- Financial loss: theft, ransom, response costs, fines and lost sales.
- Reputation damage: loss of customer trust.
- Operational disruption: downtime and lost productivity.
- Legal exposure and data loss: penalties, and stolen intellectual property.
Cyber attribution
Attribution is the process of linking an attack to an actor, group or nation. Investigators combine technical evidence (infrastructure, malware code reuse, tools and techniques, language and compile time stamps, time zone patterns) with non technical context (motive, targets, political events).
Attribution is rarely certain. Attackers use proxies, stolen infrastructure and borrowed tools, and may plant false clues, so findings are expressed as a level of confidence.
Cybercrime investigation and its challenges
An investigation follows a defined sequence: confirm the incident, secure the scene, collect and preserve evidence, analyze, report. The main challenges are:
- Volatile evidence that disappears when a system is powered off.
- Crimes that cross borders, with different laws and slow cooperation.
- Encryption and anonymity tools.
- Huge data volumes and many device types.
- Cloud data held by a third party.
- Rapidly changing technology and anti-forensics.
Indicators of compromise (IoC)
An IoC is a piece of forensic data that shows a system may have been breached. IoCs help detect an attack and also help find other affected systems.
| IoC type | Examples |
|---|---|
| Network | Unusual outbound traffic, connections to known bad IP addresses or domains, odd ports |
| Host | Unknown processes or services, new accounts, changed registry keys, unexpected files |
| File | Hashes of known malware, unusual file names or locations |
| Account | Logins at odd hours, impossible travel, privilege changes |
| Malicious sender addresses, attachments and links |
IoCs describe evidence that something already happened. They are different from indicators of attack, which describe the attacker's behavior while the attack is in progress.
Network and web application threats
Network threats include sniffing, spoofing, man in the middle, denial of service and port scanning. Web application attacks aim at the application layer.
| Attack | What it does |
|---|---|
| SQL injection | Sends database commands through input fields |
| Cross site scripting (XSS) | Injects script that runs in other users' browsers |
| Cross site request forgery (CSRF) | Tricks a logged in user into sending an unwanted request |
| Directory traversal | Reads files outside the web root using sequences such as ../ |
| Command injection | Runs operating system commands through the application |
| Broken authentication and session hijacking | Takes over a session or login |
Challenges in web application forensics
Evidence is spread over many places: web server, application, database, load balancer and web application firewall logs. Common problems are logs that are missing, rotated or too short, attacker traffic hidden in encrypted HTTPS, many users behind one proxy address (so the source address is not the real client), time zones that do not match between servers, and stateless sessions that leave little per user history.
Indications of a web attack
Look in access and error logs for these signs:
- Requests containing SQL keywords, quote characters, script tags or ../ sequences.
- Many 404, 401, 403 or 500 responses from one address in a short time.
- Unusually long URLs or parameters.
- Unknown files in the web root, such as a web shell.
- A sudden spike in traffic or outbound data.
- Defaced pages or changed content.
A worked example
A shop's logs show one address requesting the login page 4,000 times in ten minutes, then a successful login to an administrator account, then a new file help.php in the upload folder.
The repeated failures point to a brute force attempt, the successful login suggests the account was compromised, and the new file is likely a web shell. The investigator preserves the logs, images the web server and uses the file hash and source address as IoCs to search other systems.
How the exam asks about this
- "A computer that only stores a suspect's records is which category of crime involvement?" → Incidental, the computer holds evidence.
- "What is a piece of forensic data that shows a system may have been breached?" → An indicator of compromise.
- "What is the process of linking an attack to an actor?" → Attribution.
What to remember for the exam
- A computer can be the target, the tool or an incidental holder of evidence.
- Attribution combines technical and contextual evidence and is expressed as confidence.
- IoCs are evidence of a past or ongoing breach, such as bad hashes, domains and addresses.
- Web attacks show up in logs as injection strings, error spikes and strange new files.
- Missing logs, encryption, borders and volume are the usual investigation challenges.
An IP address in a log is not proof of who attacked. Proxies, shared connections and compromised hosts mean the source address needs corroboration.
Common mistakes
Treating attribution as fact. Attackers can plant false clues, so attribution remains a judgment with a confidence level.
Mixing up IoC and indicator of attack. An IoC is leftover evidence of compromise, while an indicator of attack describes the behavior as it happens.
Trusting one log source. A web investigation needs web server, application, database and firewall logs together.
Check yourself
Name the three roles a computer can play in a crime.
Target, tool, or incidental holder of evidence.
What does a file named help.php suddenly appearing in an upload folder suggest?
A web shell planted through a vulnerable upload or an earlier compromise.
Why is a source IP address in a log not enough to name the attacker?
Proxies, shared networks and compromised hosts can hide the real actor, so it needs corroborating evidence.
Topic 1 of 9 in Forensic Science
Test yourself on Forensic Science
The full EC-Council 312-49 question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.