Understanding Cyber Threats, IoCs, and Attack Methodology · Topic 1 of 4
Cyber Threats and Network Attack TTPs
Learn cyber threat actors, motives and business impact, and recognize network attack TTPs such as scanning, spoofing, DoS and DNS tunneling for CSA 312-39.
- 5 min
- Tactic is the goal, technique is the method, procedure is the specific implementation.
- APTs are skilled, well funded and stealthy, and they aim for long term access.
- Many ports on one host means a port scan. One port across many hosts means a sweep.
What it is
A cyber threat is any circumstance or actor that could exploit a vulnerability and harm an organization's systems or data. A threat becomes an attack when someone acts on it.
Tactics, techniques and procedures (TTPs) describe how attackers work. The tactic is the goal (for example, gain access), the technique is the method (for example, password spraying), and the procedure is the specific way a group carries it out.
How it works
Threat sources and actors
Threats can be natural (flood, fire), unintentional (a staff member's mistake) or intentional. Intentional threats come from inside or outside the organization.
| Actor | Typical motive | Typical capability |
|---|---|---|
| Script kiddie | Curiosity, fame | Low, uses ready made tools |
| Hacktivist | Political or social cause | Moderate, defacement and DDoS are common |
| Organized cybercriminal | Money | High, ransomware, fraud, data theft |
| Nation state or APT group | Espionage, sabotage | Very high, long and stealthy campaigns |
| Insider | Revenge, money, or simple carelessness | Has legitimate access already |
| Cyber terrorist | Fear, disruption | Varies, targets critical infrastructure |
An advanced persistent threat (APT) is a skilled, well funded attacker that keeps long term, hidden access to a target. APTs are why dwell time matters.
Impact on the organization
| Impact | Example |
|---|---|
| Financial loss | Ransom, fraud, recovery cost |
| Data breach | Stolen customer or personal data |
| Downtime | Services unavailable after DoS or ransomware |
| Reputation damage | Lost customer trust |
| Legal and regulatory | Fines and notification duties under laws such as GDPR |
| Intellectual property loss | Stolen designs or source code |
Network attack TTPs and what they leave behind
| Attack | How it works | What the SOC sees |
|---|---|---|
| Reconnaissance and scanning | Ping sweeps and port scans map live hosts and open services | One source touching many ports or many hosts, many firewall denies, IDS scan alerts |
| Sniffing | Capturing traffic to read credentials or data | Interfaces in promiscuous mode, unexpected capture tools, ARP anomalies |
| ARP spoofing (poisoning) | Fake ARP replies link the attacker's MAC to the gateway's IP | One MAC claiming several IPs, duplicate address warnings |
| IP and MAC spoofing | Forged source addresses to hide or impersonate | Packets from internal addresses arriving on the external interface |
| DNS poisoning | False DNS records send users to attacker sites | Unexpected DNS answers, domains resolving to unusual IPs |
| Man in the middle (MITM) | Attacker sits between two parties and relays traffic | Certificate warnings, ARP or DNS anomalies |
| DoS and DDoS | Floods (SYN, UDP, ICMP, HTTP) or amplification (DNS, NTP) exhaust resources | Traffic spikes, many half open TCP connections, many sources to one target |
| Session hijacking | Stealing or predicting a session token to take over a session | Same session used from two IPs or user agents |
| DNS tunneling | Data or commands hidden in DNS queries | Many long, random looking subdomains to one domain, high TXT query volume |
| Command and control (C2) beaconing | Malware calls home on a schedule | Regular outbound connections at fixed intervals to the same rare destination |
| Lateral movement | Using SMB, RDP, WMI or remote PowerShell to move between hosts | Internal logons from one host to many, admin share access, unusual RDP |
A SYN flood sends many TCP SYN packets and never completes the three way handshake, leaving the server with half open connections. An amplification attack sends small requests with a spoofed source address to services that return large answers, so the victim receives the much larger replies.
A worked example
A SIEM shows one external address that, within two minutes, received firewall denies on ports 21, 22, 23, 25, 80, 443, 445 and 3389 of one server. One hour later the IDS reports traffic to the server's port 445 that matches an SMB exploit signature, followed by outbound connections every 60 seconds from that server to a newly registered domain.
The chain is reconnaissance (port scan), exploitation of SMB, then C2 beaconing. The analyst escalates it as a likely compromise and recommends isolating the server.
How the exam asks about this
- "Firewall logs show one source receiving denies on hundreds of ports of one host. Which activity is this?" → A port scan (reconnaissance).
- "A host sends many long random subdomain queries to one domain. What is the most likely cause?" → DNS tunneling.
- "Which threat actor is driven by a political or social cause?" → Hacktivist.
What to remember for the exam
- Tactic is the goal, technique is the method, procedure is the specific implementation.
- APTs are skilled, well funded and stealthy, and they aim for long term access.
- Many ports on one host means a port scan. One port across many hosts means a sweep.
- Regular outbound connections at fixed intervals suggest C2 beaconing.
- Many half open TCP connections suggest a SYN flood.
Internal source addresses arriving from the internet side are spoofed. Edge filters should drop them, and their presence in logs is an alert on its own.
Common mistakes
Calling every traffic spike a DDoS. A spike from many sources to one target is DDoS. A spike from one internal host outbound is more likely exfiltration.
Ignoring internal traffic. Lateral movement happens inside the network, so perimeter logs alone will miss it.
Mixing threat and vulnerability. The vulnerability is the weakness. The threat is the actor or event that could exploit it.
Check yourself
What does an ARP spoofing attack leave in network data?
One MAC address claiming the IP of another host, often the gateway, and duplicate address warnings.
What makes an amplification attack effective?
Small spoofed requests trigger much larger replies, which are sent to the victim.
Which network activity is suggested by outbound connections every 60 seconds to one rare domain?
Command and control beaconing from malware on the host.
Topic 1 of 4 in Understanding Cyber Threats, IoCs, and Attack Methodology
Test yourself on Understanding Cyber Threats, IoCs, and Attack Methodology
The full EC-Council 312-39 question bank has 700 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.