2.2.2. Host-Based Indicators

💡 First Principle: Attackers use the operating system's own features to execute and persist — which means host-based indicators are found in the same places a legitimate sysadmin would work, just doing unexpected things.

Host indicators require more context than network indicators because the same events that indicate an attack (process creation, scheduled task addition, registry modification) happen during legitimate administrative work. Baselining — establishing what's normal for each system and user — is what makes these indicators meaningful.

Processor and memory consumption — Malware activities like cryptomining, password cracking, or large-scale encryption (ransomware) are computationally intensive. Unexpected CPU spikes on a server that should be idle, or a workstation whose resource usage doesn't match running applications, warrant investigation. Context: patch Tuesday causes CPU spikes; software compilation does too. Baseline first.

Unauthorized software — Applications installed without going through approved channels. Particularly suspicious: port scanners, credential dumping tools (Mimikatz), remote access tools (RATs), and anonymizing software (Tor). Detection: software inventory comparison, DLP endpoint scanning, application whitelisting.

Malicious processes — Processes that shouldn't be running on a given system. Key patterns:

• Known malware process names (though attackers rename binaries)
• Processes running from unusual locations (C:\Users\Temp\ vs. C:\Windows\System32\)
• Legitimate process names running from wrong locations (living off the land — using certutil.exe, wscript.exe for malicious purposes)
• Process injection: malicious code running inside a legitimate process (hard to detect without EDR)

Unauthorized changes and privileges — Users suddenly gaining admin rights they didn't have before, or accounts being added to privileged groups. In Active Directory, changes to Domain Admins or Enterprise Admins groups should be rare and always expected. Unauthorized privilege escalation is a key post-exploitation indicator.

Unauthorized scheduled tasks — Windows Task Scheduler and Linux cron jobs are common persistence mechanisms. Malware creates scheduled tasks that re-execute the malicious payload on a schedule (every boot, every hour, every day). Detection: audit scheduled task creation events (Windows Event ID 4698), review cron job modifications.

Registry changes and anomalies — Changes to auto-run keys, service configurations, or security policy settings. Tools like Sysmon log registry modifications with process context — you can see not just that a key was changed, but which process changed it.

File system changes and anomalies — New files in system directories, modification of system binaries (timestomping), large numbers of files being encrypted (ransomware), or files with suspicious extensions.

⚠️ Exam Trap: "Living off the land" (LOL) attacks use legitimate system tools (PowerShell, WMI, certutil, mshta) to execute malicious actions. These won't trigger signature-based antivirus because the tools are legitimate — detection requires behavioral analysis of what the legitimate tool is doing, not just what it is.

Key Windows Security Event IDs

Windows records security events by numeric ID; an analyst must recognize the high-value ones on sight:

LogonType on 4624/4625 changes the meaning: 2 = interactive (console), 3 = network (SMB/shares), 10 = RemoteInteractive (RDP). A Type 10 logon from an unexpected host, or 4648/4672 on an ordinary workstation, are classic compromise indicators.

⚠️ Exam Trap: Event 4624 by itself is not malicious — the LogonType, source host, and timing are what make it suspicious. Event 1102 (security log cleared), by contrast, is a red flag on its own.

Reflection Question: Sysmon logs show powershell.exe spawned as a child of winword.exe, followed immediately by a network connection to an external IP. Why is the parent-child relationship the key indicator here, and what attack technique does this pattern represent?