Detecting Attacks on Devices

AP Cybersecurity · Securing Devices

Detecting Attacks Against Devices

An indicator of compromise is evidence — found in logs, in files, or in behavior.

key ideaAn indicator of compromise is evidence an adversary got in. Look in logs, in files, and in behavior.

What to look for

An indicator of compromise — an IoC — is evidence that an adversary has compromised a device or network. They fall into three families by where you find them, and a real incident usually leaves all three.

Family	Found by analyzing	Indicators
host-based	logs and configuration settings	unusual files, altered configuration, unexpected scheduled tasks or services
file-based	files on the device, usually executables	a file whose hash matches known malware; file names known to be created by malware
behavior-based	authentication and access logs	multiple failed login attempts, unusual login times or locations, unauthorized access attempts

Authentication logs record every attempted login on a system, and analyzing them reveals attempted attacks. They are the single highest-yield log on most devices.

four things to hold on to

An IoC is evidence of compromise — not a suspicion and not an alert.
Auth logs record every attempted login, successful or not.
A file hash matching known malware is among the strongest single indicators available.
Behavior indicators are about pattern: when, from where, and what was reached.

Reading the evidence

Indicator of compromiseEvidence that an adversary has compromised a device or network.

Authentication logA record of every attempted login on a system — successful or not.

Host-based IoCFound by analyzing logs and configuration settings — unusual files, altered settings.

File-based IoCFound by analyzing files, usually executables — a matching hash, or a known malware file name.

Behavior-based IoCFound in authentication and access logs — failed logins, unusual times or locations, unauthorized access.

The three families are complementary, not competing. A host indicator tells you something changed, a file indicator tells you what it was, and a behavior indicator tells you who did it and when.

one device, eight minutesauth, system, file and access events interleaved

auth   03:12  FAIL  user=j.mensah  src=203.0.113.88
auth   03:12  FAIL  user=j.mensah  src=203.0.113.88
auth   03:13  OK    user=j.mensah  src=203.0.113.88
sys    03:14  CONFIG scheduled_task created  name="sysupd"  user=j.mensah
file   03:14  NEW   C:\Users\Public\svch0st.exe  sha256=8f2b...
access 03:20  READ  \\fs01\hr\salaries.xlsx  user=j.mensah  (first ever access)

03:12 FAIL ×2behavior-based — failed logins at an unusual time03:13 OKthe success that follows them — the moment this becomes an incident03:14 CONFIGhost-based — an unexpected scheduled task appears03:14 NEW filefile-based — an executable with a suspicious name in a public folder03:20 READbehavior-based — first-ever access to a sensitive file by this account

Worked analysis

EX 1

Classify the indicators

Using the log above, name each indicator and its family.

Failed logins at 03:12

Behavior-based — multiple failed login attempts, at an unusual time.

The scheduled task at 03:14

Host-based — found by analyzing configuration settings.

The new executable

File-based — a suspicious file name, and its hash can be checked against known malware.

The first-ever file access

Behavior-based — unauthorized or anomalous access to sensitive data.

State the value of the combination

Any one alone is arguable; together they are a coherent intrusion narrative with a timeline.

EX 2

Why hashes are strong evidence

A file's SHA-256 matches a known malware sample exactly. How much doubt remains?

Recall what a hash is

A one-way digest; the same input always produces the same output.

State what a match means

The file is byte-for-byte the known sample.

Address the collision objection

Collisions exist mathematically, but for a modern hash they cannot be produced on demand.

State the confidence

Very high — this is among the least ambiguous indicators available.

Note the limitation

It only recognizes known samples. A recompiled variant has a different hash entirely.

EX 3

An indicator with an innocent explanation

A user's account shows a login from an unusual location. Is this an IoC?

State the indicator

An unusual login location — a behavior-based indicator.

List the innocent explanations

Travel, a VPN, a mobile network, an office move.

State the correct posture

It is evidence worth checking, not proof of compromise.

Say what raises confidence

Corroboration — failed logins first, a config change after, access to something the user never touches.

State the analyst's rule

One indicator is a question; several that fit one story are an answer.

Check yourself

What is an indicator of compromise?

Show answer

Evidence that an adversary has compromised a device or network.

What do authentication logs record, and why do they matter?

Show answer

Every attempted login on a system. Analyzing them can reveal attempted attacks — failed attempts, unusual times, unfamiliar sources.

Where are host-based indicators found, and what do they look like?

Show answer

By analyzing logs and configuration settings — authentication logs, user activity logs, and system configuration files. Indicators include unusual files and altered configuration.

Give two file-based indicators.

Show answer

A file whose hash matches known malware, and a file name known to be created by malware — both usually found in executables.

Course map. Topic 4.4.a · LO 4.4.A — explain how to detect attacks against devices (EK 4.4.A.1–4.4.A.6: indicators of compromise as evidence of compromise; authentication logs recording every attempted login; host-based indicators from logs and configuration settings; file-based indicators such as hashes matching known malware and known malware file names; behavior-based indicators such as multiple failed logins, unusual login times or locations, and unauthorized access).