Reflected or Amplified, Spraying or Brute Force: The Non-Malware Attacks Security+ Asks You to Name From the Indicators

Objective 2.4 is written as "given a scenario, analyze indicators of malicious activity," and the scenario never says a reflected DDoS occurred. It says the DNS server's outbound traffic is thirty times its inbound, or that one badge opened doors on two floors within a minute, or that forty accounts each logged exactly two failed logins and none locked out. The malware half of the objective has its own post; this one is about everything else, and the skill runs in reverse: read the evidence, name the family, then name the attack the discriminator points to.

Five families, sorted by what they target

Hold the non-malware attacks by target, because the target decides what evidence the attack leaves. Physical attacks target the facility and leave physical evidence. Network attacks target the path and leave traffic anomalies. Application attacks target the software's trust in its input and leave malformed requests. Cryptographic attacks target the math and leave nothing broken, only something weaker. Password attacks target the credential and leave authentication logs.

The families matter because the distractors come from neighboring ones: a captured hash being reused is credential replay in the network family, and the application-family replay attack will be sitting in the answers to catch you.

Physical: force, cloning, and the building's life support

Brute force, in the physical sense, is force against a barrier: a smashed door, a pried cabinet, a stolen laptop. Its indicators are damage, forced locks, missing equipment and door-alarm events. RFID cloning reads a proximity badge and writes it to a duplicate, from inches away with a cheap handheld cloner. Its signature indicator is the same badge identifier appearing in two places, or an access event while the holder is verifiably elsewhere; the mitigation is encrypted smart cards, shielded sleeves and badge plus PIN or biometric. Environmental attacks target the facility's life support: cutting power, disabling cooling so hardware overheats, triggering fire suppression, tampering with sensors. The indicators come from facility telemetry rather than security logs, the exam's way of testing whether you look beyond the SIEM.

Network: the path is the target

A distributed denial of service overwhelms a target from many sources, and two techniques multiply it. In a reflected attack, the attacker sends requests to innocent third-party servers with the source address spoofed to the victim, so the replies bounce onto the victim; the attacker is hidden and legitimate servers become the cannons. An amplified attack chooses reflectors whose responses are far larger than the requests, DNS and NTP being the classic cases, so a small query stream becomes a flood with amplification factors in the tens to hundreds. Nearly every amplified attack is also reflected. Spoofed victim source is reflection; small request, huge response is amplification.

Three distinctions inside the table. DNS poisoning versus domain hijacking: poisoning corrupts one resolver's cache; hijacking steals the registration and affects everyone. DNSSEC defeats poisoning; registrar locks and MFA defeat hijacking. On-path is the renamed man-in-the-middle, reached through ARP poisoning, rogue access points or DNS spoofing; validated certificates are the defense, so the certificate warning is the indicator. Credential replay, pass-the-hash being the Windows classic, is defeated by MFA, unique session tokens, nonces and short session lifetimes.

Application: the software trusted its input

Every application attack is the software trusting something about its input that it should have verified: the content, the length, the timing or the origin.

Injection is hostile input executed as code or a query, SQL, command, LDAP or XML; the indicators are database errors in logs and input containing quotes, semicolons or keywords. Buffer overflow is oversized input overwriting adjacent memory to crash the target or run attacker code; the indicators are crashes on long input and memory-access violations. Privilege escalation is a foothold expanding its rights, vertically from user to administrator or horizontally to another user's access; the indicators are standard accounts performing administrative actions and unexpected group membership changes. Directory traversal manipulates a file path with sequences such as ../ or the encoded %2e%2e%2f to escape the web root and read files the application never meant to serve; the indicator is that sequence in requests.

Replay and forgery are the pair to separate. Replay captures legitimate traffic and re-transmits it later to repeat its effect; the indicator is the same transaction arriving twice from different places, and the defenses are nonces, timestamps and one-time tokens. Forgery makes a system accept an attacker-crafted request as genuine: cross-site request forgery makes a victim's own logged-in browser submit a request the victim never intended; server-side request forgery makes the server fetch attacker-chosen URLs. The CSRF indicator is actions performed by users who deny them.

Cryptographic: nothing breaks, something gets weaker

A downgrade attack coerces two parties that both support strong cryptography into negotiating a weaker protocol version or cipher, then breaks the weak one. POODLE forced connections down to SSL 3.0, and on-path attackers commonly strip or downgrade TLS. The indicator is a connection using an older version than both endpoints support; the defense is disabling legacy versions and weak suites outright, because the strong option was already there and the attacker talked both sides out of it.

A collision attack finds two different inputs that produce the same hash, so a malicious file can pass an integrity check or signature as a benign one, which is why MD5 and SHA-1 are banned for signatures. The birthday attack is the shortcut that makes collisions findable: just as twenty-three people give a fifty percent chance of a shared birthday, an attacker searching for any two colliding inputs needs about 2^n/2 attempts against an n-bit hash, not 2ⁿ. Collision is the outcome, birthday is the method, and the defense for both is a longer modern hash such as SHA-256.

Password: wide or deep

Brute force is many passwords against one account, loud by design: a flood of failures on one account trips the lockout. Spraying is a few passwords against many accounts, one or two common passwords tried across the whole directory while staying under the lockout threshold on each. Spraying is quiet per account and noisy across the organization: the same password failing against dozens of usernames, often from one source. Credential stuffing is not a 2.4 bullet but a favorite distractor: breached username and password pairs from one site replayed against another.

The reverse lookup: nine indicators, and the attacks they point to

The objective closes with nine indicators, and this is the direction the questions run: read the observation, then name what it most likely means. Detection rarely rests on one indicator. A realistic chain runs impossible travel, then out-of-cycle logging, then resource consumption, then either resource inaccessibility or missing logs, and the combination names the attack more clearly than any single symptom.

Three carry most of the marks. Impossible travel and concurrent session usage both mean the credential is in someone else's hands, and the response is to revoke sessions and reset, not to block an address. Resource consumption changes meaning with where you observe it: on a victim it is the attack; on a DNS server whose outbound dwarfs its inbound, you are the reflector in someone else's attack. Missing logs reverses the usual logic: absence is the evidence, because logs do not delete themselves, and the countermeasure is shipping logs in real time to a write-once store. The malware indicators and threat actor attributes sit on either side of this objective.

Four stems, decoded

1. A DNS server shows outbound traffic thirty times its inbound, all responses to queries from a single external address. A reflector in an amplified DDoS against that address. Rate limit and close open recursion; the "attacker" is the victim.
2. Forty user accounts each record two failed logins from one IP address within an hour; none are locked out. Password spraying. The lockout never fired because the attacker stayed under the threshold on each account.
3. Users typing the correct address of the payroll site land on a look-alike; the authoritative DNS records are unchanged. DNS poisoning of the local resolver. Had the registrar records changed, it would be domain hijacking.
4. A bank customer's browser submits a transfer while the customer is logged in and browsing an unrelated forum. Cross-site request forgery. Nothing was captured; the customer's own session was used.

Indicators of malicious activity are objective 2.4 of Security+ Domain 2, Threats, Vulnerabilities and Mitigations, 22% of the exam and the domain's largest objective. Work all 27 Domain 2 topics, from threat actors through every vulnerability type and mitigation, with our Security+ Domain 2 study guide.

#SecurityPlus #SY0701 #IndicatorsOfCompromise #DDoS #OnPathAttack #PasswordSpraying #ExamPrep #CompTIA #InfoSec #CyberSecurity