Understanding Cyber Threats, IoCs, and Attack Methodology · Topic 2 of 4
Host and Application Attack TTPs
Recognize host attack TTPs such as malware, privilege escalation and persistence, and web application attacks like SQL injection and XSS for CSA 312-39.
- 5 min
- Fileless malware and living off the land abuse built in tools, so watch process creation and command lines.
- 4698 is a scheduled task created, 7045 a new service, 1102 a cleared Security log.
- SQL injection leaves quotes,
UNION SELECTand HTTP 500 errors in web logs.
What it is
Host attacks target a single system: a workstation or server. The attacker runs code, gains higher privileges, steals credentials and makes access survive a reboot.
Application attacks target software, most often web applications. They abuse weak input handling, authentication or access control to read data, run commands or take over accounts.
How it works
Malware types
| Type | Key behavior |
|---|---|
| Virus | Attaches to files and needs a user action to spread |
| Worm | Spreads on its own across the network |
| Trojan | Looks legitimate but carries a hidden payload |
| Ransomware | Encrypts files and demands payment, often steals data first |
| Rootkit | Hides itself and other malware deep in the system |
| Remote access trojan (RAT) | Gives the attacker remote control |
| Keylogger and spyware | Records keystrokes and activity |
| Fileless malware | Runs in memory using built in tools such as PowerShell, leaving few files on disk |
Host attack TTPs and their signs
| Technique | What it means | What the SOC sees |
|---|---|---|
| Password attacks | Brute force, dictionary, password spraying, rainbow tables | Many failed logons (4625), lockouts (4740) |
| Credential dumping | Reading passwords or hashes from memory (LSASS) or the SAM | A process opening lsass.exe (Sysmon event 10), known dumping tools |
| Pass the hash and pass the ticket | Reusing a stolen NTLM hash or Kerberos ticket without the password | Network logons (type 3) using NTLM from unusual hosts, odd ticket requests |
| Privilege escalation | Gaining admin or SYSTEM rights through a flaw or misconfiguration | Special privileges logons (4672) for unexpected accounts, new admin group members (4732) |
| Persistence | Registry Run keys, scheduled tasks, new services, startup folder, WMI subscriptions | Task created (4698), service installed (7045 in the System log, 4697 in Security) |
| Living off the land | Abusing trusted binaries such as powershell.exe, certutil.exe, mshta.exe or rundll32.exe | Process creation (4688 or Sysmon 1) with encoded commands or downloads |
| Defense evasion (ATT&CK v20: Stealth and Defense Impairment) | Process injection and clearing logs (Stealth), disabling antivirus (Defense Impairment) | Security log cleared (1102), AV service stopped, code injected into other processes |
Office applications starting a command shell or PowerShell is a classic host IoC. A normal Word document has no reason to launch powershell.exe.
Application attack TTPs and their signs
| Attack | How it works | Sign in web or application logs |
|---|---|---|
| SQL injection (SQLi) | Input changes the meaning of a database query | ' OR 1=1, UNION SELECT, database error messages, HTTP 500 errors |
| Cross site scripting (XSS) | Script is injected into pages other users view (stored, reflected or DOM based) | <script> tags or javascript: in parameters, often URL encoded |
| Cross site request forgery (CSRF) | A logged in user's browser is tricked into sending an unwanted request | State changing requests with a foreign Referer |
| Command injection | Input is passed to an operating system shell | Shell characters such as ; or && followed by commands such as whoami in parameters |
| Directory traversal | ../ sequences reach files outside the web root | ../../etc/passwd or encoded %2e%2e%2f in requests |
| File inclusion (LFI and RFI) | The app loads a local or remote file named in input | Parameters containing file paths or external URLs |
| Server side request forgery (SSRF) | The server is made to request internal resources | Parameters containing internal addresses or cloud metadata addresses |
| Broken authentication | Credential stuffing, weak session handling | Many failed logins across many accounts, HTTP 401 bursts |
| Web shell upload | A script uploaded through a weak upload form gives remote control | New script files in upload folders, requests to them with command parameters |
The OWASP Top 10 is the standard awareness list of web application risks. Injection, broken access control and security misconfiguration are among its long standing entries.
A worked example
A web server's access log shows one address sending a request to /products.php?id=5 followed by requests where the id value ends in a single quote, then UNION SELECT strings, with a run of HTTP 500 responses and then a 200 response much larger than normal.
This is SQL injection: probing for errors, then extracting data. On the database server, the host log shows a new process created by the database service a few minutes later, suggesting the attacker moved from application to host.
How the exam asks about this
- "A web log entry contains
../../../etc/passwdin a parameter. Which attack is this?" → Directory traversal. - "Sysmon shows a process opening lsass.exe memory. What is the attacker most likely doing?" → Credential dumping.
- "Which event ID shows a new service was installed, a common persistence step?" → 7045 (System log).
What to remember for the exam
- Fileless malware and living off the land abuse built in tools, so watch process creation and command lines.
- 4698 is a scheduled task created, 7045 a new service, 1102 a cleared Security log.
- SQL injection leaves quotes,
UNION SELECTand HTTP 500 errors in web logs. - XSS injects script that runs in other users' browsers. CSRF abuses a logged in user's session.
- Directory traversal uses
../to escape the web root.
Attackers URL encode payloads to slip past simple filters. %27 is a single quote and %3Cscript%3E is <script>, so decode before you decide a request is clean.
Common mistakes
Confusing XSS with CSRF. XSS runs attacker script in the victim's browser. CSRF makes the browser send a request the user did not intend.
Trusting a process because its file is legitimate. powershell.exe is a Microsoft binary, but what matters is its parent process and command line.
Reading one failed logon as an attack. A single 4625 is normal. Many in a short time, or one password tried against many accounts, is the pattern.
Check yourself
What is the difference between password spraying and brute force?
Brute force tries many passwords on one account. Spraying tries a few common passwords across many accounts to avoid lockouts.
What does fileless malware leave behind instead of files?
Process activity, command lines, script logs and registry entries, rather than an executable on disk.
Which web log sign suggests command injection?
Parameters containing shell characters such as
;or&&followed by commands likewhoami.
Topic 2 of 4 in Understanding Cyber Threats, IoCs, and Attack Methodology
Test yourself on Understanding Cyber Threats, IoCs, and Attack Methodology
The full EC-Council 312-39 question bank has 700 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.