Detecting Attacks on Devices
Введено| English | Значение |
|---|---|
| indicator of compromise/ˈɪndɪkeɪtə ɒv ˈkɒmprəmaɪz/ | индикатор компрометации |
| password spraying/ˈpæswɜːd ˈspreɪɪŋ/ | распыление паролей |
| credential stuffing/krɪˈdenʃl ˈstʌfɪŋ/ | подмена учётных данных |
| endpoint detection and response/endˈpɔɪnt dɪˈtekʃn ænd rɪˈspɒns/ | обнаружение и реагирование на конечных узлах |
Indicators of compromise
- Logs reveal an indicator of compromise (IoC) 入侵指标 — evidence an adversary got in.
- Host-based IoCs: unexpected processes or changed settings.
- File-based IoCs: a file whose hash matches known malware.
Reading auth logs
- Many wrong passwords for one user = a guessing attack.
- Many users failing from one IP = password spraying 密码喷洒.
- A burst of default credentials = credential stuffing 撞库.
Signs of a compromised device
Read the log: which password attack?
One user + many wrong passwords = guessing; many users + one IP = spraying; default credentials = stuffing.
Evidence in a log that an adversary has compromised a device is an...
Сложность 1/5 · 100 монет + небольшой бонус за первое выполнение сегодня
An IoC is an indicator of compromise.
Many different users failing to log in from ONE IP address suggests...
Сложность 1/5 · 100 монет + небольшой бонус за первое выполнение сегодня
One IP, many users = password spraying.
A powerful third-party device-detection service is called ____ (endpoint detection and response).
Сложность 1/5 · 100 монет + небольшой бонус за первое выполнение сегодня
EDR is powerful but expensive.
Which are kinds of indicators of compromise? (Choose all)
Сложность 2/5 · 140 монет + небольшой бонус за первое выполнение сегодня
There is no weather-based IoC.
Choosing detection
- Signature-based is lighter — better for weak devices.
- An endpoint detection and response (EDR) 端点检测与响应 service is powerful but costly.
- Some attacks cannot be detected on the device at all.
Offline password attacks cannot be detected. The adversary already stole the hash database and is cracking it on their own computer, far from your logs. This is a favourite exam "gotcha" — the only defense is strong, salted hashing.
Offline password attacks set off lockout alarms on your login server.
Сложность 1/5 · 100 монет + небольшой бонус за первое выполнение сегодня
False. Offline cracking happens on the adversary's own machine against a stolen hash file, so your systems see no failed logins to detect.
An auth log shows 50 failed logins for user admin in 30 seconds, all from one IP. That pattern — one account, many wrong passwords, fast — is the signature of an online password-guessing attack that can be blocked with a lockout policy.
Device attacks leave an IoC in logs (host-based, file-based, behaviour-based). Auth logs distinguish guessing (one user), spraying (many users, one IP), and stuffing (default credentials). Pick detection by device power (EDR is powerful but costly). Offline attacks cannot be detected.