CH4: Attacks and Indicators of Malicious Activity

Introduction

Once threat actors gain access to systems, their behavior leaves traces: changed files, suspicious network connections, unusual processor usage, and behavioral anomalies that security teams can detect and investigate. Understanding the types of attacks actors conduct and the indicators they leave behind is essential for incident response, threat hunting, and forensic investigation.

This chapter moves from understanding how threats enter systems to examining what they do once inside. You will learn to categorize malware, recognize social engineering tactics, understand network attacks, and identify the behavioral and technical signatures that reveal compromise.

By the end of this chapter, you will be able to identify malicious activity based on observable indicators, understand the mechanisms underlying attacks, and contribute meaningfully to incident response and threat hunting.

Learning Objectives

After completing this chapter, you will be able to:

1. Classify malware families (ransomware, trojans, spyware, rootkits, logic bombs) and explain their mechanisms and impact.
2. Identify social engineering attacks and the psychological principles that make them effective.
3. Explain network-based attacks including denial of service, man-in-the-middle, DNS manipulation, and protocol downgrade attacks.
4. Describe application-level and credential attacks including injection, buffer overflow, privilege escalation, and password attacks.
5. Recognize and interpret indicators of compromise (IoCs) including file hashes, suspicious network activity, process behavior, and user behavior anomalies.

---

4.1 Malware

Malware is software designed to compromise system confidentiality, integrity, or availability. Malware is distributed through attack vectors described in Chapter 3 (email, web, USB) and executes on target systems with the privileges of the user who ran it.

Ransomware

Ransomware encrypts victim data and demands payment for decryption. Ransomware has become the most financially damaging category of malware, with organizations paying millions in ransom.

Encryption-Based Ransomware

Traditional encryption-based ransomware uses strong cryptography (AES-256, RSA) to render data unreadable. The attacker possesses the decryption key and offers it in exchange for payment. Victims face a choice: pay the ransom, restore from backups (if available), or lose the data permanently.

Figure 4.1. A ransomware extortion screen. The countdown timer is a social engineering device rather than a technical one; it pressures the victim to decide before consulting counsel, insurers, or incident responders.

Double and Triple Extortion

Modern ransomware campaigns employ double extortion: the attacker exfiltrates sensitive data before encrypting it, then threatens to publicly release the data if ransom is not paid. This approach targets organizations with backups that can restore data without paying ransom.

Triple extortion escalates further by threatening to disclose stolen data to customers, regulators, or competitors, causing reputational and regulatory harm regardless of whether the organization restores from backups.

Figure 4.2. The escalation from single to triple extortion. Each added layer targets a different recovery path, which is why reliable backups alone no longer neutralize a ransomware incident.

Ransomware as a Service (RaaS)

Ransomware as a Service is a criminal business model where developers create ransomware and lease it to affiliates who conduct attacks. The RaaS operator handles payments, provides technical support, and negotiates with victims. Affiliates handle initial compromise and access. This division of labor reduces friction and enables less-technical criminals to conduct ransomware campaigns.

Figure 4.3. The ransomware-as-a-service ecosystem. Specialization means the person who breaches the network, the person who wrote the malware, and the person who negotiates payment are usually three different parties, which complicates attribution.

Warning

Paying ransom to ransomware operators is increasingly illegal in jurisdictions with sanctions against certain threat actors. Organizations paying ransom to sanctioned entities may face legal liability. Additionally, paying ransom incentivizes future attacks and funds criminal enterprises.

Trojans and Worms

Trojans are malware that appears to be legitimate software but contains hidden malicious functionality. Trojans are distribution vehicles for other malware: a user downloads what appears to be a legitimate application, and instead, a backdoor is installed.

Backdoors are persistent mechanisms allowing remote access to systems. Once installed, backdoors allow attackers to return to systems at will, bypassing normal authentication.

Figure 4.4. How a trojan delivers a backdoor. The application often performs its advertised function, so the user receives no signal that anything is wrong and the malicious component is never suspected.

Worms are malware capable of self-replication and propagation without user interaction. Worms spread through network vulnerabilities, auto-executing commands on target systems to propagate further. The Morris Worm, released in 1988, was the first widely known worm and infected approximately 10% of Internet-connected computers at the time despite executing unintentionally due to a bug.

Spyware, Adware, and Keyloggers

Spyware monitors user activity and exfiltrates sensitive information: browsing history, credentials, emails, or financial data. Spyware often runs with user-level privileges but can act on data the user has access to.

Keyloggers record keystrokes, capturing passwords, search queries, and confidential information. Hardware keyloggers are physical devices inserted between a keyboard and computer; software keyloggers run as background processes.

Adware displays unwanted advertisements or modifies search results to redirect traffic to attacker-controlled sites. While less damaging than ransomware or spyware, adware degrades system performance and user experience.

Rootkits and Bootkit Persistence

Rootkits are malware families designed to hide themselves from detection. Rootkits operate at a privilege level above normal user processes (kernel mode on Windows/Linux) and intercept system calls to hide their presence:

• Hidden processes: System calls to list running processes return incomplete data, hiding the rootkit.
• Hidden files: File system queries omit files belonging to the rootkit.
• Hidden network connections: Network monitoring tools report connection lists with rootkit connections removed.

Rootkits are more difficult to detect than standard malware because legitimate security tools cannot observe them. Detection requires specialized tools running at the same privilege level as the rootkit or forensic techniques examining storage media outside the running system.

Bootkits are rootkits that persist in the system firmware or bootloader. A bootkit executes before the operating system loads, gaining control before any security software launches. Bootkits are particularly persistent and dangerous because booting from an alternative OS or removing the hard drive does not eliminate the threat.

Figure 4.5. Rootkit and bootkit persistence by privilege layer. The deeper the malware sits, the less the layers above it can be trusted to report accurately, which is why detection must come from outside the running system.

Logic Bombs and Time Bombs

Logic bombs are malicious code triggered by specific conditions or events. A disgruntled system administrator might insert code that deletes critical databases if their user account is deactivated. Upon termination, the employee's account is disabled, and the logic bomb triggers.

Figure 4.6. A logic bomb triggered by account deactivation. The malicious code is planted while the insider still holds legitimate access, so the destructive act and the authorized access are separated in time, which is what makes it difficult to attribute.

Time bombs are logic bombs triggered by specific dates or times. A logic bomb might remain dormant until a specific date and then execute destructively.

Fileless Malware

Fileless malware executes without writing files to disk, using built-in system tools and living in system memory. Fileless malware often leverages PowerShell, WMI (Windows Management Instrumentation), or shell scripts.

Fileless malware is difficult to detect because:

• Standard antivirus software scans files on disk; fileless malware never exists on disk.
• Behavioral monitoring is required to detect suspicious use of legitimate system tools.
• Forensic investigation is complicated because memory is volatile and is overwritten when the system shuts down.

Putting It Together: Analyzing a Ransomware Attack

Your organization detects suspicious file creation and rapid encryption of shared network drives. Investigation reveals:

1. Initial access: Phishing email with malicious attachment (trojan dropper).
2. Staging: The trojan downloaded additional components including credential harvesting tools and reconnaissance scripts.
3. Privilege escalation: Using vulnerability CVE-2024-XXXX, the attacker escalated privileges to local administrator.
4. Lateral movement: The attacker used harvested credentials to access file servers and domain controllers.
5. Encryption: Ransomware encrypted all accessible network shares, rendering thousands of files inaccessible.
6. Extortion demands: The attacker posted stolen data samples to a dark web site, demanding USD 500,000 in cryptocurrency.

Indicators observed: - Process execution chains showing parent-child relationships unusual for legitimate workflows. - Suspicious command-line arguments to system tools (whoami, net group, etc.). - Large volume of file operations (read/encrypt/write) occurring rapidly. - Outbound network connections to known C2 infrastructure. - Unusual user login activity from elevated administrative accounts.

Lessons: - Ransomware attacks are typically multi-stage, with indicators at each stage. - Detecting the initial phishing or trojan stage is preferable to detecting encryption (too late for prevention). - Behavioral monitoring and anomalous activity detection are essential for early detection. - Credential hygiene (limiting administrative credential use, implementing MFA) limits lateral movement.

---

4.2 Social Engineering

Social engineering exploits human psychology to manipulate victims into performing actions against their security interests. Unlike technical exploits that target software vulnerabilities, social engineering targets human vulnerabilities.

Psychological Principles

Effective social engineering leverages well-researched psychological principles:

Authority

Humans are conditioned to comply with authority figures. Attackers impersonate supervisors, IT support, law enforcement, or other authorities to compel compliance. "Your account violates company policy; I need you to change your password immediately" is more persuasive than "I need your password."

Figure 4.7. The authority principle. The countermeasure is procedural rather than perceptual: verify the request through a channel the recipient selects, not one the sender supplies.

Urgency and Scarcity

Creating time pressure bypasses careful deliberation. "Your account will be locked in 1 hour unless you verify now" creates urgency. Scarcity ("Only 5 spots remaining") creates artificial competition.

Figure 4.8. The urgency and scarcity principle. Artificial deadlines exist to prevent verification, so a request that punishes delay should raise suspicion rather than compliance.

Reciprocity

Humans are motivated to repay favors. An attacker might help a target with a minor issue to build rapport, then request access as a reciprocal favor. "I helped you with the printer problem; can you let me into the data center real quick?"

Figure 4.9. The reciprocity principle. The obligation created by a small favor is real and felt, which is why access decisions must rest on policy rather than on the individual employee's judgment in the moment.

Trust and Consistency

Humans trust those who appear similar to themselves (dress, speech, references to shared interests). Once a person commits publicly to a position, they tend to defend that position even if it becomes detrimental. An attacker builds trust through subtle commonalities, then requests consistency ("You're a helpful person, right? Can you help me access...?").

Figure 4.10. The trust and consistency principle. Rapport built over many low-stakes interactions is used as collateral for one high-stakes request, so each request must be evaluated on its own merits.

Social Proof

Humans model behavior based on others. An attacker might reference actions taken by colleagues ("Your colleague Sarah already reset her credentials; please do the same") to imply legitimacy.

Figure 4.11. The social proof principle. The claim that others have already complied is cheap to fabricate and rarely checked, which makes it one of the most reliable levers in a pretext.

Pretexting

Pretexting is the creation of a false scenario to build trust and extract information. An effective pretext includes:

• Assumed familiarity: Reference to shared context or colleagues (real or inferred).
• Organizational knowledge: Demonstrating understanding of the target's organization, processes, or systems.
• Credible motivation: A plausible reason for requesting the information.
• Authority: Positioning as someone with legitimate authority to request information.

Example: "Hi, I'm Jake from IT. I'm helping our outsourced vendor perform a security audit. Can you tell me what password manager you're using? We need to ensure it's on our approved list."

The attacker demonstrates organizational knowledge (mentions IT and security audit), provides authority (IT department), and creates plausible motivation (vendor audit).

Impersonation and Deepfakes

Impersonation attacks exploit the difficulty in verifying identity remotely. An attacker might:

• Email spoofing: Send emails appearing to originate from executives or external business partners.
• Phone impersonation: Call targets claiming to be from IT, HR, or external partners.
• Account compromise: Compromise a legitimate email or social media account to send communications that appear to come from a trusted party.

Deepfake videos and audio use AI to create synthetic media appearing to show real people saying things they never said. A deepfake video of an executive requesting emergency fund transfer could be highly persuasive.

Phishing Variants

Phishing variants exploit specific organizational or personal contexts:

• Spear-phishing: Personalized phishing targeting specific individuals with research-informed details.
• Whaling: Spear-phishing targeting high-value individuals (executives, board members).
• CEO fraud: Impersonating executives requesting wire transfers or credential changes.
• Account takeover phishing: Emails appearing to come from legitimate organizations (banks, email providers) requesting credential verification.

---

4.3 Physical Attacks

While not network-based, physical attacks provide direct access to systems and information.

Tailgating and Dumpster Diving

Tailgating (piggybacking) occurs when an unauthorized person follows an authorized employee through a secured door. A person carrying coffee and a briefcase might appear legitimate, causing employees to hold doors open.

Dumpster diving involves searching trash for discarded documents, passwords written on sticky notes, or other sensitive information. This low-tech approach often reveals organizational secrets.

Shoulder Surfing and Skimming

Shoulder surfing is observation of a user entering credentials or sensitive information. An attacker stands nearby and watches a user unlock a computer, enter a PIN, or input a password.

Skimming involves installing hidden devices on legitimate equipment (ATM card readers, PIN pads) to capture credentials or payment card data. Installed skimmers are difficult to detect visually.

---

4.4 Network Attacks

Denial of Service (DoS) and Distributed Denial of Service (DDoS)

A Denial of Service attack overwhelms a system or network, exhausting resources and making services unavailable to legitimate users. DoS attacks exploit computational or bandwidth limits:

• Volumetric attacks: Flooding a service with massive traffic volume, consuming bandwidth.
• Protocol attacks: Exploiting protocol weaknesses (SYN floods targeting TCP handshake) to consume resources.
• Application attacks: Exploiting application logic to consume resources (sending complex database queries).

Figure 4.12. A SYN flood as it appears in a packet capture. The signature is structural rather than volumetric: connection requests arrive with no matching acknowledgements, so half-open connections accumulate and exhaust the server's connection table.

A Distributed Denial of Service attack is a DoS attack from multiple sources. DDoS is more difficult to defend against because blocking a single source does not stop the attack. Botnets (networks of compromised computers) are commonly used to conduct DDoS attacks.

Figure 4.13. A botnet-driven DDoS attack. Because the traffic originates from thousands of legitimate consumer devices, blocking by source address is impractical and mitigation must occur upstream at the network or provider level.

On-Path Attacks

An on-path attack (formerly called man-in-the-middle) occurs when an attacker positions themselves between two communicating parties, intercepting and potentially modifying communications.

Example: An attacker on a coffee shop network intercepts unencrypted HTTP traffic. When a user logs into an email account, the attacker captures the credentials. The attacker then impersonates the user to the email server, accessing the victim's email.

On-path attacks are most effective against unencrypted protocols (HTTP, FTP, Telnet). HTTPS, SSH, and VPN connections are resistant to on-path attacks due to encryption, but vulnerabilities in implementation or user behavior (ignoring certificate warnings) can still allow compromise.

DNS Attacks

DNS spoofing involves sending fraudulent DNS responses, redirecting domain names to attacker-controlled servers. If an attacker can intercept DNS queries or compromise DNS servers, they can redirect traffic from legitimate websites to phishing pages or malware distribution sites.

Figure 4.14. DNS spoofing. The forged answer wins because it arrives first, and the browser displays the domain the user typed, so nothing in the address bar indicates the redirection.

DNS amplification attacks use public DNS servers to reflect and amplify attack traffic in DDoS attacks. An attacker sends queries to many DNS servers with a spoofed source IP (the victim's IP). The servers respond with large answers to the victim's address, overwhelming it.

Figure 4.15. DNS amplification. The attacker spends a small amount of bandwidth and the resolvers supply the rest, so the traffic reaching the victim can exceed the attacker's own connection capacity by an order of magnitude or more.

Spoofing and Sniffing

Spoofing is sending packets with false source addresses, impersonating other systems. IP spoofing sends packets with false source IP addresses; ARP spoofing sends false ARP (Address Resolution Protocol) messages, associating an attacker's MAC address with another system's IP address.

Packet sniffing captures network traffic using tools like tcpdump or Wireshark. On shared network media (switched networks are less vulnerable than older hub-based networks), an attacker in promiscuous mode receives all traffic, enabling credential theft from unencrypted protocols.

Protocol Downgrade Attacks

Protocol downgrade attacks force communications to use weaker, older versions of protocols. For example:

• An attacker intercepts TLS 1.3 negotiation and forces the connection to use TLS 1.0, which contains exploitable weaknesses.
• An HTTPS connection is downgraded to HTTP through SSL stripping, removing encryption.

Protocol downgrade attacks rely on implementations supporting legacy versions; disabling weak protocol versions mitigates this attack class.

---

4.5 Application and Credential Attacks

Injection Attacks

Injection vulnerabilities occur when applications fail to distinguish between code and data. Untrusted input is treated as code and executed.

SQL Injection

SQL injection exploits vulnerable database queries. A web application might construct a query like:

query = "SELECT * FROM users WHERE username = '" + user_input + "'"

If a user enters admin' --, the query becomes:

SELECT * FROM users WHERE username = 'admin' --'

The -- comments out the rest of the query, returning the admin user's data.

Figure 4.16. SQL injection against a login portal. The two-hyphen comment marker removes the password condition entirely, so the database evaluates a query the developer never wrote and returns a row the attacker was never authorized to see.

SQL injection can allow: - Unauthorized data access (reading other users' records). - Data modification (updating or deleting records). - Remote code execution (if the database supports executing system commands).

Command Injection

Command injection exploits applications that construct system commands from user input. A vulnerable script might execute:

system("ping -c 1 " + host_parameter)

An attacker might provide 8.8.8.8; rm -rf / as the host parameter. The system executes both commands: a ping to 8.8.8.8 and deletion of critical files.

Buffer Overflow

Buffer overflow exploits memory management weaknesses in C and C++ programs. When a program reads input into a fixed-size buffer without checking bounds, excess input overwrites adjacent memory.

Example: A function allocates a 50-byte buffer but reads 500 bytes from user input. The excess 450 bytes overwrite adjacent memory, potentially including: - Function return addresses (allowing code execution redirection). - Pointer values (allowing arbitrary memory writes). - Security-relevant variables (disabling access checks).

Figure 4.17. A stack buffer overflow. Because the return address sits above the buffer in memory, an overflow long enough to reach it can redirect execution to an address the attacker chooses.

Buffer overflow vulnerabilities are particularly dangerous in network-facing services and services running with elevated privileges. Modern protections (address space layout randomization, stack canaries, data execution prevention) mitigate buffer overflow risks but do not eliminate them entirely.

Privilege Escalation

Privilege escalation allows a user with limited permissions to gain higher-level access.

Vertical escalation grants administrator or system-level privileges. Horizontal escalation accesses another user's account at the same privilege level.

Privilege escalation exploits include: - Kernel vulnerabilities: Unpatched OS vulnerabilities allowing user processes to execute code at kernel level. - Misconfigured applications: SUID (Set User ID) binaries that execute with owner privileges but accept arbitrary parameters. - Token impersonation: Attackers steal or impersonate authentication tokens of higher-privileged users.

Replay Attacks and Credential Forgery

Replay attacks involve capturing authentication credentials or valid messages and reusing them without authorization. If credentials are transmitted unencrypted or in deterministic format, attackers can capture and replay them.

Example: A user authenticates to a web application over unencrypted HTTP. The browser sends an authentication cookie with each request. An attacker on the network captures the cookie and sends it to the server, impersonating the user.

MFA Bypass

Multi-Factor Authentication (MFA) requires multiple authentication factors (something you know, have, or are). MFA bypass techniques include:

• SIM swapping: Attackers convince mobile carriers to transfer phone numbers to attacker-controlled devices, intercepting SMS-based authentication codes.
• Credential harvesting: Attackers trick users into entering MFA codes into phishing pages or fake MFA applications.
• Session fixation: Attackers establish authenticated sessions before the user logs in, then trick the user into using the attacker's session.

Putting It Together: Detecting Injection and Privilege Escalation

A web application logs show suspicious database activity:

1. SQL Injection Attempt: Application logs show a request with input ' OR '1'='1. This is a classic SQL injection payload designed to bypass authentication by making the WHERE clause always true.

2. Privilege Escalation: After initial compromise, the attacker runs sudo -l to list available commands, then executes sudo vi, which provides a shell at root privileges through improper sudoers configuration.

3. Lateral Movement: The attacker uses root access to modify SSH configuration, creating a persistent backdoor account.

Detection: - Web Application Firewalls (WAF) can detect and block common SQL injection patterns. - Command logging can reveal the execution of sudo -l and suspicious sudo usage. - File integrity monitoring can detect modifications to SSH configuration. - Behavioral analysis can identify unusual privilege elevation patterns.

---

4.6 Indicators of Compromise

An Indicator of Compromise is observable evidence that a system has been compromised or is actively under attack. IoCs are the signals that enable detection and incident response.

Figure 4.18. The four evidence domains that produce indicators of compromise. Any single indicator can have an innocent explanation, so confidence comes from correlating indicators across domains rather than from any one signal.

File Hashes and Malware Signatures

File hashes (MD5, SHA-1, SHA-256) uniquely identify files. A file known to be malicious has a specific hash; systems scanning file hashes can detect copies of that malware.

Antivirus signatures are pattern-matching rules identifying malware. Signatures are effective against known malware but ineffective against new or modified variants (polymorphic malware that changes its hash with each execution).

Suspicious IP Addresses and Domains

Command and control (C2) infrastructure are servers attackers use to communicate with compromised systems. IoCs include: - IP addresses of C2 servers. - Domain names used by C2 infrastructure. - URLs hosting malware or hosting credentials.

Threat intelligence feeds regularly publish C2 indicators. Detecting outbound connections to known C2 infrastructure is a high-confidence indicator of compromise.

Malicious Processes and Command-Line Arguments

Process monitoring reveals system activity. Suspicious indicators include:

• Unexpected processes: PowerShell or cmd.exe spawning from non-administrative tools.
• Suspicious command-line arguments: Encoding/decoding tools (certutil, base64), registry modification tools (reg.exe), or credential access tools (mimikatz).
• Process execution chains: An unexpected sequence of parent-child process relationships.

Example: notepad.exe spawning powershell.exe is unusual (notepad typically doesn't launch PowerShell). This process chain might indicate malware disguised as notepad.

Timestamp Anomalies

Suspicious timestamps indicate attacker activity:

• File modification time mismatches: Malware modifying files but maintaining false timestamps to hide activity.
• Log deletion: Attackers clearing event logs to remove evidence (itself a suspicious activity).
• Unusual access times: Files accessed during off-hours by unexpected accounts.

Resource Consumption Anomalies

Unusual resource usage indicates malware or attack activity:

• High CPU usage: Ransomware consuming CPU to encrypt files. Cryptominers consuming resources to generate cryptocurrency.
• High network bandwidth: Malware exfiltrating data or conducting DDoS attacks.
• High disk I/O: Ransomware performing rapid reads and encryption operations.
• Memory growth: Malware or memory leaks consuming increasing amounts of RAM.

Behavioral Indicators

Behavioral analysis looks for patterns consistent with attack activity rather than specific technical signatures:

Account Lockout Patterns

Account lockout events indicate password guessing or brute-force attacks. Multiple lockouts on a single account or lockouts across many accounts within a short timeframe suggest attack activity.

Impossible Travel

Impossible travel is a user login from two geographically distant locations within a timeframe too short to travel between them. Example: A user logs in from New York at 9:00 AM and from Tokyo at 9:15 AM. This pattern suggests account compromise or credential theft.

Concurrent Sessions

A user with multiple concurrent sessions from different locations may indicate: - Legitimate remote access and office work (valid). - Account compromise and attacker access (concerning).

Behavioral analysis considers user role, usual access patterns, and organizational norms to distinguish legitimate from suspicious concurrent sessions.

Unusual Network Connections

Network traffic to unexpected destinations (uncommon ports, foreign IP ranges, known malicious domains) indicates compromise.

Privilege Elevation Patterns

Unexpected privilege elevation (a standard user running commands as administrator) or use of privileged accounts outside their normal pattern indicates attack activity.

Analyst Perspective

The most valuable IoCs are behavioral indicators because they are difficult for attackers to fake. A file hash can be changed by modifying a single byte of malware. A domain can be abandoned if detected. But unusual login patterns or resource consumption spikes reveal actual attacker behavior and are harder to deceive.

Putting It Together: Building an IoC Profile

Your organization detects a potential compromise. Investigation identifies the following IoCs:

Technical Indicators: - File hash 5d41402abc4b2a76b9719d911017c592 (known Emotet trojan variant). - Process chain: explorer.exe > powershell.exe > cmd.exe > certutil.exe. - Outbound connection to IP 203.0.113.45 (known Emotet C2). - Scheduled task created: "Windows Update" running powershell in 10-minute intervals.

Behavioral Indicators: - Login to compromised user account from IP geographically inconsistent with user location. - Execution of credential harvesting tools (mimikatz) using administrative privileges. - Unusual network connections to file servers at 2:00 AM (outside business hours). - Multiple failed login attempts on service accounts shortly before successful compromises.

Figure 4.19. The same intrusion expressed as a timeline of indicators. Reading the indicators in sequence rather than as a list shows the intrusion's progression and identifies the earliest point at which detection was possible.

Response: 1. Immediately isolate the compromised system from the network. 2. Block the C2 IP and associated domains at the firewall. 3. Reset passwords for all potentially compromised accounts. 4. Investigate lateral movement by examining access logs and process execution on file servers. 5. Conduct threat hunt for other systems exhibiting the same IoCs or behavioral patterns. 6. Preserve evidence for forensic investigation and potential law enforcement involvement.

---

Chapter Summary

• Malware ranges from ransomware (financial extortion) to trojans (access mechanisms) to spyware (information theft). Modern malware often combines multiple functions and uses multiple persistence mechanisms.

• Ransomware has evolved from simple encryption attacks to double/triple extortion campaigns. Ransomware as a Service enables less-technical criminals to conduct sophisticated attacks.

• Rootkits hide malware from detection by operating at elevated privilege levels. Bootkits persist across OS reinstallation by residing in firmware.

• Fileless malware uses legitimate system tools (PowerShell, WMI) for execution, leaving minimal disk artifacts and making detection reliant on behavioral analysis.

• Social engineering exploits human psychology through authority, urgency, reciprocity, trust, and social proof. Effective social engineering combines organizational knowledge with credible motivation.

• Pretexting and impersonation build false scenarios to extract information. Deepfakes expand impersonation attacks to include synthetic video and audio.

• Network attacks including DoS/DDoS, on-path attacks, and DNS spoofing exploit protocol weaknesses or network infrastructure. Encryption and protocol security (HTTPS, SSH) mitigate many network attacks.

• Injection attacks (SQL, command) exploit application code that executes untrusted input as code. Input validation and parameterized queries prevent most injection attacks.

• Buffer overflow attacks exploit memory management vulnerabilities in compiled languages. Modern protections reduce but do not eliminate buffer overflow risk.

• Indicators of Compromise include file hashes, suspicious network connections, unusual processes, and behavioral anomalies. Behavioral indicators are more valuable than static IoCs because they reveal actual attacker activity.

• Detecting compromise early requires layered monitoring: file integrity, process execution, network connections, resource consumption, and user behavior. No single indicator is sufficient; effective detection combines multiple data sources.