Please enable JavaScript.
Coggle requires JavaScript to display documents.
Analyzing Potentially Malicious Activity - Coggle Diagram
Analyzing Potentially Malicious Activity
Network Attack Indicators
Traffic Spikes & DDOS
DDOS :arrow_right: generate massive traffic
traffic spike :arrow_right: sudden increase
bandwidth consumption
Host Attack Indicators
Memory & Processor Consumption
top
free
Disk & File System Use
data staging & exfil
file system viewers
dir
drive capacity consumption
Linux analysis tools
lsof
df
du
cryptography tools
Unauthorized Software
worms
viruses
trojans
unauthorized scheduled tasks
file/registry changes
Malicious Process
process analysis for Windows
Sysinternals suite
tasklist
taskkill
PE Explorer
Core Windows Processes
system.exe :arrow_right: pid=4
smss.exe
csrss.exe
wininit.exe
services.exe
lsass.exe
process analysis for linux
ps
pstree
Unauthorized Change
unauthorized privileges
auditing account usage
abnormal behavior
Data Exfiltration
Vulnerability Assessment Tools
Nessus
OpenVAS
Qualys
NMAP Discovery Scan
TCP SYN (-sS)
TCP connect (-sT)
TCP flags (-sF/-sN/-sX)
UDP scans (-sU)
Port range (-p)
Port States
Open
Closed
Filtered
Unfiltered
Open | Filtered
Closed | Filtered
NMAP Fingerprinting
protocol
app name & version
OS type & version
host name
device type
Measuring Social Engineering
attack types
pretexting
baiting
phishing
simulate social engineering attacks
phishing campaigns
URL Obfuscation
URL shorteners
URL un-shortening
unshorten.me
VirusTotal
QR codes
URL doppelgangers
character swapping
URL encoding
URL redirects
Additional Tools
Angry IP Scanner
Maltego
Metasploit Framework (MSF)
Recon-ng