2.2.2. Host-Based Indicators

💡 First Principle: Attackers use the operating system's own features to execute and persist — which means host-based indicators are found in the same places a legitimate sysadmin would work, just doing unexpected things.

Host indicators require more context than network indicators because the same events that indicate an attack (process creation, scheduled task addition, registry modification) happen during legitimate administrative work. Baselining — establishing what's normal for each system and user — is what makes these indicators meaningful.

Processor and memory consumption — Malware activities like cryptomining, password cracking, or large-scale encryption (ransomware) are computationally intensive. Unexpected CPU spikes on a server that should be idle, or a workstation whose resource usage doesn't match running applications, warrant investigation. Context: patch Tuesday causes CPU spikes; software compilation does too. Baseline first.

Unauthorized software — Applications installed without going through approved channels. Particularly suspicious: port scanners, credential dumping tools (Mimikatz), remote access tools (RATs), and anonymizing software (Tor). Detection: software inventory comparison, DLP endpoint scanning, application whitelisting.

Malicious processes — Processes that shouldn't be running on a given system. Key patterns:

• Known malware process names (though attackers rename binaries)
• Processes running from unusual locations (C:\Users\Temp\ vs. C:\Windows\System32\)
• Legitimate process names running from wrong locations (living off the land — using certutil.exe, wscript.exe for malicious purposes)
• Process injection: malicious code running inside a legitimate process (hard to detect without EDR)
• Fileless malware runs entirely in memory (injected code, PowerShell, WMI), so there is no executable on disk for file-based antivirus to scan; memory forensics (for example Volatility) shows a running process or code region with no backing file image

Unauthorized changes and privileges — Users suddenly gaining admin rights they didn't have before, or accounts being added to privileged groups. In Active Directory, changes to Domain Admins or Enterprise Admins groups should be rare and always expected. Unauthorized privilege escalation is a key post-exploitation indicator.

Unauthorized scheduled tasks — Windows Task Scheduler and Linux cron jobs are common persistence mechanisms. Malware creates scheduled tasks that re-execute the malicious payload on a schedule (every boot, every hour, every day). Detection: audit scheduled task creation events (Windows Event ID 4698), review cron job modifications.

System binary proxy execution (T1218), also called signed binary proxy execution: attackers run code through trusted, signed Windows binaries such as rundll32.exe, mshta.exe, regsvr32.exe, and msiexec.exe. rundll32.exe loading a just-created DLL from a user-writable folder such as C:\Users\Public is this technique (T1218.011). Contrast DLL hijacking (T1574.001), which plants a DLL where a legitimate program's search order will load it, and process hollowing (T1055.012), which replaces the memory of a suspended legitimate process. Suspicious PowerShell command lines combine -ExecutionPolicy Bypass (-ep bypass), -WindowStyle Hidden, -NonInteractive, and -EncodedCommand (-enc); a task named like a Windows component that runs such a command, with no matching update activity, is persistence.

Registry changes and anomalies — Changes to auto-run keys, service configurations, or security policy settings. Tools like Sysmon log registry modifications with process context — you can see not just that a key was changed, but which process changed it.

File system changes and anomalies — New files in system directories, modification of system binaries, or altered file timestamps (timestomping, ATT&CK T1070.006), large numbers of files being encrypted (ransomware), or files with suspicious extensions.

⚠️ Exam Trap: "Living off the land" (LOL) attacks use legitimate system tools (PowerShell, WMI, certutil, mshta) to execute malicious actions. These won't trigger signature-based antivirus because the tools are legitimate — detection requires behavioral analysis of what the legitimate tool is doing, not just what it is.

Key Windows Security Event IDs

Windows records security events by numeric ID; an analyst must recognize the high-value ones on sight:

LogonType on 4624/4625 changes the meaning: 2 = interactive (console), 3 = network (SMB/shares), 10 = RemoteInteractive (RDP). A Type 10 logon from an unexpected host, or 4648/4672 on an ordinary workstation, are classic compromise indicators. Type 3 on a file server is ordinary SMB access, but it is also how pass-the-hash and other lateral movement with stolen credentials appears, so judge it by source host and timing. A long run of 4625 failures from one external source followed by a 4624 success is the signature of a brute-force attack (spread thinly across many accounts, of password spraying); a Type 10 success on internet-exposed RDP after such a run means the attacker guessed their way in, whereas phished or intercepted credentials work first time and leave no failed-logon burst. A gap in Security log entries during an attack window points to log clearing even when no 1102 event survives; compare with copies already forwarded to the SIEM.

⚠️ Exam Trap: Event 4624 by itself is not malicious — the LogonType, source host, and timing are what make it suspicious. Event 1102 (security log cleared), by contrast, is a red flag on its own.

Reflection Question: Sysmon logs show powershell.exe spawned as a child of winword.exe, followed immediately by a network connection to an external IP. Why is the parent-child relationship the key indicator here, and what attack technique does this pattern represent?