Ransomware, Rootkits, and Logic Bombs: Malware Types and the Indicators Security+ Expects You to Spot
Chris Rees
25+ years in IT · Pluralsight author, 4.6/5 across 2,000+ ratings
Objective 2.4 of Security+ is the one candidates dread because of its length: malware types, physical attacks, network attacks, application attacks, cryptographic attacks, password attacks, and then a list of indicators. It looks like a memorization exercise. It is not. Every item on the list is a behavior, and the exam tests whether you can recognize the behavior from a description. Learn what each thing does rather than what it is called, and the list collapses into a handful of patterns.
Malware is classified by behavior, not by name
The first thing to unlearn is the idea that malware types are like animal species. They are more like verbs. A single piece of malicious code can be a worm in how it spreads, a trojan in how it arrived, and ransomware in what it does. The exam question will describe one of those behaviors and ask for the term, so sort the list by the question it answers.
The single most tested distinction on the left is virus versus worm: a virus needs a host file and a user action, a worm propagates on its own. If the stem says the infection spread across the network overnight with nobody logged in, it is a worm. The most tested item on the right is the logic bomb, because it comes with a story: a developer is let go, and three weeks later the payroll database is wiped. The condition (the developer's account being disabled, or a date passing) is the signature.
Fileless malware deserves a sentence because it breaks the mental model candidates arrive with. It runs from memory using legitimate tools already on the system, typically scripting engines, so there is no file for a signature scanner to find. The defense the exam wants is behavioral detection and restricting the scripting tools, not a better antivirus signature.
The attack families beyond malware
Objective 2.4 lists several other attack families, and they follow the same rule: recognize the behavior.
| Family | What the stem describes | The terms it maps to |
|---|---|---|
| Physical | force, cloning, tampering with hardware | brute force (of a lock or door), RFID cloning, environmental attacks on power or cooling |
| Network | traffic being flooded, redirected or intercepted | DDoS (amplified, reflected), DNS poisoning and domain hijacking, wireless deauthentication and evil twin, on-path (interception), credential replay, malicious code |
| Application | input crafted to make software misbehave | injection, buffer overflow, replay, privilege escalation, forgery (request forgery), directory traversal |
| Cryptographic | weakening or defeating encryption | downgrade (forcing a weaker protocol), collision (two inputs, one hash), birthday (the math that makes collisions likely) |
| Password | guessing credentials | spraying (one password across many accounts), brute force (many passwords against one account) |
Two of those pairs are perennial. Spraying versus brute force: spraying tries one common password against every account to stay under lockout thresholds; brute force hammers one account with many passwords and trips the lockout. If the stem mentions many accounts and no lockouts, it is spraying. Downgrade is the cryptographic attack that does not break anything: it persuades both ends to negotiate an older, weaker protocol that can be broken, which is why disabling legacy protocol versions is the fix rather than a stronger key.
The application attacks, in the detail the exam wants
The application row deserves more than a cell, because these are the attacks that come with the most recognizable descriptions.
- Injection is untrusted input executed as code or a query: SQL injection reads or alters a database through a form field, command injection runs operating system commands. The stem describes input containing quotes, semicolons or commands, and the fix is input validation and parameterized queries.
- Buffer overflow is input larger than the space reserved for it, spilling into adjacent memory and, in the classic case, overwriting the return address so the attacker's code runs. The stem mentions unusually long input and a crash or unexpected code execution; the fixes are bounds checking, and the platform protections (address space layout randomization, data execution prevention) that make the overflow unreliable.
- Race condition, in its time-of-check to time-of-use form, is the gap between a program verifying something and acting on it. The stem describes a check that passed and an action that should not have, with a change in between.
- Privilege escalation is a user or process gaining rights it should not have, vertically (user to administrator) or horizontally (one user to another's data). The stem describes an account doing something above its station.
- Directory traversal is a URL or path containing sequences that climb out of the intended folder to read files elsewhere on the server. The stem will include something that looks like a path with dot-dot segments.
- Forgery covers cross-site request forgery, where a victim's browser is tricked into sending a request the attacker chose using the victim's existing session. The stem describes an action the user did not intend, taken while logged in.
- Replay captures a valid exchange and resends it. Session tokens, authentication handshakes and wireless frames are the usual targets, and the fix is timestamps, nonces or short-lived tokens that make the captured copy useless.
The pattern across all seven is that the software trusted something it should have validated: the length, the content, the timing or the origin of an input.
The indicators: how the stem tells you what happened
The last section of the objective is the one worth the most, because indicators are what scenario questions are built from. CompTIA names nine, and each points at a family of attack.
Three of these carry most of the marks. Impossible travel and concurrent sessions are the identity pair: both mean the credential is in someone else's hands, and the response is to revoke sessions and reset, not to block an IP address. Resource consumption versus resource inaccessibility is a sequence: encryption is consumption while it runs, and inaccessibility when it finishes, which is why a spike in disk activity on a file server is the last moment to act on ransomware. And missing logs is the one that reverses the usual logic: absence of evidence is the evidence, because logs do not delete themselves.
Four stems, decoded
- Overnight, every workstation on a subnet began scanning its neighbors and CPU usage spiked across the floor. Self-propagation with no user involved: a worm. The indicator is resource consumption.
- A contractor's account logged in from two continents forty minutes apart, and the help desk received a second MFA prompt the user did not request. Impossible travel plus an unexpected prompt: credential compromise in progress. Revoke sessions and reset; the account, not the network, is the problem.
- Three weeks after a systems administrator was terminated, a scheduled task deleted the backup catalog. A condition (the date, or the account's removal) triggered a payload: a logic bomb, and an insider threat.
- Users report that shared drives are inaccessible and files carry an unfamiliar extension, following an email with an invoice attachment. Resource inaccessibility after a trojan delivery: ransomware. The invoice is the vector, the extension is the indicator, and the question is usually about which one.
Why the objective matters beyond the exam
Indicators are the raw material of detection. Every alert a SIEM produces is one of these patterns expressed as a rule, and every incident response begins with one of them being noticed. The reason Security+ makes you learn them by name is that the names are shared vocabulary between the analyst who sees the indicator and the responder who acts on it. That is also why they reappear, at greater depth, in CySA+ and in the threat actor profiles that explain who tends to leave which trail.
Key takeaways
- Malware types are behaviors, not species. Sort them by "how did it arrive" (virus, worm, trojan, fileless) and "what does it do" (ransomware, spyware, keylogger, rootkit, bootkit, logic bomb).
- Virus needs a user and a host file; a worm spreads alone. A logic bomb waits for a condition, and the condition is the clue.
- Spraying is one password across many accounts; brute force is many passwords against one. Lockouts point to brute force, their absence to spraying.
- Downgrade attacks break nothing. They negotiate a weaker protocol, so the fix is disabling legacy versions.
- Know the nine indicators and what each signals. Impossible travel and concurrent sessions mean a stolen credential; missing logs mean someone cleaned up.
Malware and the indicators of malicious activity are objective 2.4 of Security+ Domain 2, Threats, Vulnerabilities and Mitigations, 22% of the exam. Work all 27 Domain 2 topics, from threat actors and vectors through vulnerability types and mitigations, with our Security+ Domain 2 study guide.
#SecurityPlus #SY0701 #Malware #Ransomware #Rootkit #IndicatorsOfCompromise #ThreatDetection #BlueTeam #CompTIA #CyberSecurity
Know your enemy
Threats, Vulnerabilities & Mitigations is 22% of Security+. Study all 5 objectives (threat actors, attack vectors, vulnerability types, indicators, and mitigations) across 27 topics with 75 practice questions.
Get the Domain 2 guideKeep reading
MSA, SOW, SLA, BPA, NDA: The Third-Party Risk Alphabet, and Which Document Answers Which Question
Your vendors are your attack surface, and Security+ Domain 5 tests whether you know the paperwork that manages them. Objective 5.3 end to end: the vendor lifecycle from due diligence to offboarding, the agreement stack (master agreement, statements of work, service levels, business partners, non-disclosure, memoranda), right-to-audit and rules of engagement, questionnaires and ongoing monitoring, and supply chain analysis.
Read Security+ deep divesEstablish, Deploy, Maintain: Secure Baselines, Hardening Targets, BYOD vs. COPE vs. CYOD, and WPA3 on Security+
Objective 4.1 is the widest bullet in the biggest domain, and it hides its questions in verbs and ownership: which baseline step failed when settings drifted, which mobile model gives the least control, why WPA3 ends the offline handshake attack, which application control stops which flaw. The baseline lifecycle, hardening emphasis by device class, site surveys and heat maps, MDM and deployment models, 802.1X with RADIUS, and the application security checklist, decoded the way the exam asks them.
Read Security+ deep divesSPF, DKIM, DMARC, and Friends: The Enterprise Security Capabilities Security+ Expects You to Configure
Objective 4.5 is where Security+ stops asking what a control is and starts asking where it goes. Email authentication drawn as one flow (SPF checks the sender, DKIM signs the message, DMARC decides what happens), web and DNS filtering, DLP and what it can actually see, EDR versus XDR, NAC posture checks, file integrity monitoring, and the placement map that answers every scenario in the objective.
ReadFollow Skillthropic
Keep learning between study sessions
The same exam-focused teaching, in smaller pieces, wherever you scroll.
Enjoyed this? Get the AI security news that matters.
Join The AI Security Brief for the top AI security news, plus what's important to the C-suite. Free, straight to your inbox.
No spam. Unsubscribe anytime.