What are indicators of attack?

Question

Options

• Alarge numbers of requests for the same file
• Bmultiple log ins from different regions
• Cswells in database read volume
• Dsuspicious registry or system file changes

• A
  3% (1)
• B
  5% (2)
• C
  3% (1)
• D
  90% (35)

Explanation

Indicators of Attack (IoAs) are signs that an attack is actively taking place or that the attacker's goals are in progress. Suspicious registry or system file changes are clear indicators that an attacker may be trying to compromise or control a system by modifying critical system Other options are more of Indicators of Compromise (IoCs) than an IoAs: Large numbers of requests for the same file could be an indicator of abnormal behavior (such as a DDoS attack or bot scraping), but it is not necessarily a direct indicator of an attack in progress. It could be a performance issue or a malicious behavior. Multiple logins from different regions are more of a behavioral anomaly and typically falls under IoCs as a sign of compromise. It doesn't indicate the specific method or goal of an attack but suggests a potential breach. While unusual, swells in database read volume could indicate something like a large query, backup, or data exfiltration. IoAs focus on the tactics, techniques, and procedures (TTPs) attackers use during an attack, while IoCs are artifacts left behind after a compromise.

No community discussion yet for this question.