2.2.3. Application and Social Engineering Indicators
💡 First Principle: Application-layer indicators and social engineering attacks target the human and software elements that network and host controls don't cover — they succeed because they look like legitimate use.
Application-based indicators:
Anomalous activity — Behavior from an application or user account that deviates from established patterns. Examples: a user who normally accesses 20 documents per day suddenly accessing 2,000; an API that normally processes 100 requests/hour suddenly processing 10,000; a service account accessing resources it's never touched before.
Introduction of new accounts — Unexpected user account creation, especially privileged accounts, in applications or directories. Attackers create backdoor accounts to maintain access even if their initial foothold is remediated. Detection: monitor for account creation events in IAM and application logs.
Unexpected output — Application generating responses it shouldn't: error messages containing database schema details (SQL injection probe), server banner information disclosure, or internal file paths in error responses. These can indicate both active attacks and misconfigurations.
Unexpected outbound communication — An application server that normally only accepts inbound connections suddenly making outbound connections may indicate C2 malware installed via web shell or deserialization attack.
Service interruption — Unexpected application downtime can indicate ransomware, destructive malware, or a DDoS attack against the service. The investigation starts with determining whether the interruption is accidental (bug, capacity) or intentional (attack).
Social engineering indicators:
Obfuscated links — URLs that hide their true destination using URL shorteners, Unicode lookalike characters, or long subdomains (paypa1.malicious-site.com). Any link that requires extra analysis to determine its destination is suspicious.
Pretexting and impersonation — Requests that invoke authority, urgency, or familiarity to manipulate behavior. "This is IT, we need your password immediately to fix a critical issue" is textbook social engineering. Email indicators include mismatched display names and email addresses, impersonation of executives (BEC attacks), and unusual request patterns.
Disguised file names — A double extension such as invoice_final.pdf.exe abuses Windows hiding known extensions: the file looks like a PDF but its real, final extension is executable. Paired with a believable business pretext (an invoice the user expects), it is pretexting plus file extension spoofing. It is a different technique from vishing (a phone call) or a watering hole (a compromised website the victim visits). In logs, look for executables launched from Downloads or an email attachment path.
| Indicator Category | Example | Primary Log Source |
|---|---|---|
| Anomalous user behavior | 1000 file downloads in 5 minutes | Application/DLP logs, UEBA |
| New privileged account | New Domain Admin at 2am | Active Directory event logs |
| SQL injection probe | Error: syntax error near 'OR 1=1' in app log | Web application/WAF logs |
| C2 from app server | Outbound connection from web server | Network firewall/proxy logs |
| BEC email | CEO display name with external sender domain | Email gateway logs (header analysis) |
| Obfuscated link | bit.ly/xH3kP2 in security alert email | Email filtering / proxy logs |
Cloud control-plane indicators. Changes to cloud identities are recorded by the cloud audit log: AWS CloudTrail for IAM actions such as CreateUser, CreateAccessKey, and AttachUserPolicy. VPC Flow Logs and CloudWatch metrics do not record who changed a policy, and AWS Config tracks configuration state over time, not the actor. AssumeRole from a workload (EC2 instance) role into an admin role, then CreateUser, then AttachUserPolicy granting AdministratorAccess is privilege escalation followed by persistence through a backdoor admin account; routine key rotation or deployment automation does not create new admin users.
⚠️ Exam Trap: Application logs are an often-overlooked log source in SIEM deployments. Many organizations collect OS and network logs but fail to forward application logs, creating a blind spot to application-layer attacks like SQL injection, web shell uploads, and API abuse.
Typosquatting, URL Shorteners, and Business Email Compromise
Typosquatting registers domains that differ from a trusted one by a misspelling, a swapped character (0 for o, rn for m), or a different top-level domain, and relies on users misreading or mistyping them. MITRE ATT&CK covers it under Acquire Infrastructure: Domains (T1583.001). Indicators: a newly registered domain in WHOIS, a name one or two characters from a brand you use, and traffic that arrives from email or text links.
URL shorteners (bit.ly and similar) do not imitate anything: they hide the destination behind a redirect. The analyst's job is to expand the link without loading the final page, through the shortener's preview feature (Bitly shows one when + is appended to a link) or a scanning service such as URLScan.io that renders the page on its own infrastructure. A DNS lookup of the shortener's hostname only returns the shortening service's own servers.
Business email compromise (BEC) uses a spoofed, lookalike, or genuinely compromised mailbox to request a payment, a change of bank details, or sensitive data. Vendor account compromise is the hardest variant to spot, because the message comes from the supplier's real mail system, often inside an existing thread, and passes SPF, DKIM, and DMARC. FBI IC3 guidance is to verify any change in payment details through a secondary channel: call a known contact on a number from existing records, never one supplied in the request.
Social engineering by channel: phishing (mass email) and spear phishing (targeted email) arrive by email, vishing by voice call, and smishing by SMS text. A credential-harvesting page is a lookalike login (for example a Microsoft 365 sign-in clone) that captures what is typed; URLScan.io renders such a page safely and shows the brand impersonation. Do not confuse it with a watering hole (compromising a site the targets already visit to serve drive-by malware), pharming (redirecting name resolution so the correct address reaches a fake server), or BEC (a payment or data request with no harvesting page).
⚠️ Exam Trap: A BEC message usually carries no malware and no malicious link, so content filters have little to catch. The control is a process (out-of-band verification), not a signature.
Reflection Question: A financial application's audit log shows the CFO's account downloading 500 sensitive financial documents at 3:14am on a Saturday. The CFO is in a different time zone and confirms they were asleep. What two explanations should the analyst consider, and what evidence would distinguish between them?
