In this lesson, we're going to look at
some of the indications of malware attacks.
Now, your understanding of the various indicators
of malware attacks is going to be essential
as you progress in your career
as a cybersecurity professional.
By recognizing the signs of a malware attack early on,
you can better mitigate the damage
that these attacks may cause to your systems.
Now, there are nine common indicators
of malware attacks that you should be aware of,
including account lockouts,
concurrent session utilization, blocked content,
impossible travel, resource consumption,
resource inaccessibility, out-of-cycle logging,
missing logs, and published or documented attacks.
Let's take a quick look at each
of these different types of indications.
First, we have account lockouts.
Now, malware, especially those designed
for credential theft or brute force attacks,
will trigger multiple failed login attempts
that could result in a user's account being locked out.
These lockouts aren't merely an inconvenience though,
they're a bright red flag that somebody
is trying to break into your network.
If you suddenly see a lot of your users
cannot access their accounts anymore
despite not entering an incorrect password,
or if there's an unusual surge in locked accounts
across your enterprise network,
this could be a good indication
of a malware attack that's underway.
Second, we have concurrent session utilization.
Now, our users should typically only have
one active session at any given time inside of our network.
If you notice that a single user account
has multiple simultaneous or concurrent sessions open,
especially from various geographic locations,
this should really be a cause for concern and suspicion.
Seeing concurrent session utilization
may be a good indication that some kind of malware
has hijacked the user's account
is now using it for their own malicious activities.
Third, we have blocked content.
Modern cybersecurity tools are usually going to be equipped
with the ability to block known malicious content
such as certain types of files or links.
If there's a sudden increase in
the amount of blocked content alerts
you're seeing from your security tools,
this is a strong indication that a malware infection
may have successfully penetrated your system.
Fourth, we have impossible travel.
Now, impossible travel refers to a scenario
where a user's account is accessed from two
or more geographically separated locations
in an impossibly short period of time.
For example, I just logged into my system
from Orlando, Florida about 10 minutes ago.
Now, if you see right now, that I'm trying
to log in from New York City,
this would be considered impossible travel
because it takes more than 10 minutes
to fly from Orlando to New York.
It takes about three hours.
Usually, if we see impossible travel,
this is an indication that a user's account
has been compromised, and it's often due
to some kind of malicious activity,
or as an aftermath of a successful malware attack
that was able to harvest your user's credentials
like their username and password.
Fifth, we have resource consumption.
Now, many forms of malware, especially Cryptominers,
botnets, and worms, can consume a significant amount
of system resources once you've been infected by them.
If you're observing any unusual spikes in CPU, memory,
or network bandwidth utilization
that can't be linked back to a legitimate task,
that could be an indication
that you're the victim of a malware attack.
High resource consumption can also lead to system slowdowns
that make it very noticeable and impactful
that you have a malware injection occurring.
Sixth, we have resource inaccessibility.
Now, ransomware is a form of malware
that encrypts user files
to make them inaccessible to the user.
If you have a large number of files or critical systems
that are suddenly inaccessible to you,
Or if users receive messages demanding payment
to decrypt their data, this is a pretty clear sign
of a ransomware based malware attack.
Seventh, we have out-of-cycle logging.
Now, logs are crucial for understanding
our systems and their various activities.
If you're noticing that your logs
are being generated at odd hours,
or during times when no legitimate activities
should have been taking place,
such as in the middle of the night
when no employees are actively working,
this could be an indication
that you're the victim of a malware attack.
This kind of out-of-cycle logging could reveal
that unauthorized data transfers or system modifications
are being conducted by an attacker.
So it's important to review your logs regularly
to detect these types of infections.
Eighth, we have missing logs.
Now, missing logs can be a very alarming sign for us
as cybersecurity professionals.
Often, we're going to see that a threat actor
or attacker will delete your system logs
in order to hide their own tracks
after successfully breaching your system.
So, if you're conducting a log review
as a cybersecurity analyst, and you see
there's a large gap in your logs,
or if the logs have been cleared out completely
without any authorized reason,
this could be a good indication
that you are the victim of some kind of
malicious activity or malware attack.
And this means somebody is trying to cover their tracks.
Ninth and finally, we have published and documented attacks.
Now, this one is pretty obvious,
but if a cybersecurity researcher or reporter
publishes a report that shows that
your organization's network has been infected
as part of a botnet or other malware based attack,
this will serve as your notice that you've been attacked.
Now, hopefully your organization has
well-trained cybersecurity professionals
who will know that you've been
the victim of a malware infection
before you read about it on the cover of the New York Times.
But if you don't, this is the final way
that you will know that you are the victim
of a malware attack because it's sitting there
right on the front page of the newspaper.
So remember, you must first recognize
the indications of malware attacks
if you have any hope of responding against them.
While some indications are pretty overt
and in your face like a ransom demand from ransomware,
or an article being published
on the front page of the New York Times,
others can be much more subtle,
and require a more in-depth and careful observation.
Like unusual resource consumption
or unexpected account lockouts.
By regularly monitoring your system's health,
user activities, and logs, you're going to be
in a much stronger position to promptly detect
and respond to any malware threats
that may occur against your systems.