Investigate indicators of malicious activity across an environment

Authentication indicators gain meaning through distribution and sequence. Password spraying commonly tries a small set of passwords across many accounts; credential stuffing reuses username-password pairs; brute force concentrates repeated guesses on fewer accounts. A successful sign-in after failures deserves context, but failure volume alone is not proof of compromise.

Correlate account, source, device, application, result, and authentication method. A familiar managed device and completed phishing-resistant authentication can reduce suspicion, while a new unmanaged device, impossible travel, or legacy protocol can raise it. Preserve the raw events before disabling or resetting accounts.

A single indicator rarely establishes malicious activity. A newly created scheduled task can be legitimate administration; encoded scripting can be deployment automation; a rare outbound destination can be a new vendor. Confidence rises when process ancestry, persistence, file origin, destination reputation, and timing form one coherent sequence.

Network indicators include unexpected beacon intervals, unusual protocols, DNS patterns, and data volume. Endpoint indicators include suspicious parent-child processes, credential access, unsigned binaries, and persistence changes. Correlation should preserve alternative explanations and distinguish observed facts from inference.

One open port or administrative binary is not automatically malicious. Network analysis asks whether the device is owned, the port is expected, the peer is appropriate, and the sequence resembles discovery or transfer. Host analysis adds process ancestry, signer, command line, file activity, resource use, and user context.

LOLBins are legitimate operating-system tools that adversaries may abuse. Their evidentiary value comes from an unexpected parent, argument, account, destination, or timing. Exfiltration requires evidence of data selection and transfer; a large outbound flow is a lead until host or content evidence connects it to protected data.

Named Windows LOLBins and what each is abused for: certutil.exe downloads files (certutil -urlcache -f <url> <file>) and Base64-encodes or decodes them; bitsadmin.exe creates background transfer jobs that download or copy files; mshta.exe executes HTA files or inline VBScript and JScript; rundll32.exe runs an exported function from a DLL; regsvr32.exe fetches and runs a remote scriptlet (regsvr32 /s /n /u /i:<url> scrobj.dll), which can bypass application allowlists; wmic.exe starts processes locally or on remote hosts (wmic process call create). ATT&CK groups several of these under System Binary Proxy Execution (T1218). On Linux the same idea applies to curl, wget, bash, python, and cron. Suspicious signs are an Office or browser parent, a URL or encoded blob in the arguments, execution from a user-writable path, or an outbound connection from a binary that rarely makes one. Beaconing appears as connections to one destination at near-regular intervals with similar sizes; DNS tunneling appears as many long, random-looking subdomain queries to a single domain.

Application errors, cloud scaling, and configuration changes can share a timestamp without sharing a cause. Analysts correlate the control-plane actor, changed object, deployment record, service health, and affected identity. Impossible travel can be a proxy artifact; a new token, unmanaged device, or privilege change makes it more actionable.

Typosquatting substitutes a confusingly similar registered name. URL shorteners hide the final route but are not malicious by definition. BEC is a workflow attack: the decisive evidence may be a lookalike reply address, altered mailbox rule, unusual payment request, or failed out-of-band confirmation rather than an attachment.