Simple explanation
This lesson catalogs the specific signals — grouped by where they show up — that tell an analyst something might be wrong: network, host, application, and human indicators.
Technical explanation
Network-related indicators: bandwidth consumption spikes, beaconing (regular outbound check-ins to an external host, classic C2 signature), irregular peer-to-peer communication, rogue devices appearing on the network, and scan/sweep activity (an attacker enumerating what's reachable).
Host-related indicators: capacity consumption (CPU/memory/disk unexpectedly maxed), unauthorized software installed, malicious processes running, suspicious memory contents (e.g., injected code), unauthorized changes to configuration or files, unauthorized privileges (an account with more access than it should have), and execution/persistence mechanisms — especially scheduled tasks created without authorization, a common way malware survives a reboot.
Application-related indicators: anomalous activity within the app itself, introduction of new accounts that shouldn't exist, unexpected output, unexpected outbound communication from an app that shouldn't be reaching the internet, service interruption, and suspicious entries in application logs specifically (as distinct from OS logs).
Other indicators: social engineering attempts — often the first sign of an incident is a human reporting something suspicious, not a tool alerting.
Synonyms / related terms
| Term | Means | |---|---| | Beaconing | Regular, low-and-slow outbound C2 check-ins | | IOC | Indicator of Compromise — the general term for any of these signals | | C2 | Command and Control |
Concept Check
"A workstation sends a small outbound connection to the same external IP every 60 seconds, at a consistent interval, regardless of user activity." This is the textbook definition of beaconing — not a scan (which probes many targets), not credential replay (no authentication event described) — the defining feature is the fixed, regular interval independent of what the user is actually doing.
Interview-style Q&A
Q: Why is a new scheduled task specifically worth flagging, more than other configuration changes? A: "Scheduled tasks are one of the most common persistence mechanisms — malware uses them to survive a reboot or re-execute after being killed. An unauthorized scheduled task isn't just a configuration anomaly; it's often the attacker's insurance policy against being cleaned up once."
Memory trick
"Network Beacons, Hosts Hoard, Apps Act Weird, Humans Report" — four categories of indicator, each tagged to a simple verb capturing its character.