2.2. Indicators of Potentially Malicious Activity

💡 First Principle: No single indicator proves malicious activity — indicators have context, and the analyst's job is to assess whether a collection of indicators, combined with environmental context, exceeds the threshold for investigation or escalation.

An indicator is a piece of evidence suggesting something may be wrong. A single indicator is a question mark. Multiple correlated indicators pointing to the same hypothesis become a finding. This is why SIEM correlation rules exist — they combine indicators across data sources into a coherent picture that a single log entry couldn't provide.

The CySA+ exam organizes indicators into three categories: network-based, host-based, and application/social engineering. The exam will present you with a scenario and ask you to identify the most likely explanation or the correct next action — which requires understanding what each indicator actually means, not just its name.

⚠️ Common Misconception: Beaconing traffic always uses unusual or high-numbered ports. Sophisticated C2 traffic deliberately uses ports 80 and 443 to blend with legitimate web traffic. The indicator for beaconing is the pattern (regular intervals, consistent payload sizes) — not the port number.