Which of the following is the best conclusion?

The user's password may be compromised, even though the logins succeeded

The server is infected with a worm

Nothing is wrong, because every login succeeded

A company learns its user:password hash database was stolen last month. Its authentication logs show nothing unusual. What should it do?

Force every user to reset their password

Lock only accounts with failed logins

Nothing, because the logs show no attack

An analyst is reviewing access logs for behavior-based indicators of compromise. Which of the following is one?

Repeated attempts by a standard user to gain administrator privileges

An approved software update installed overnight

A file name known to be created by malware

Which detection approach best fits the smart sensors?

Signature-based detection, or detection off the device

Anomaly-based detection on each sensor, to reduce false negatives

Anomaly-based detection on each sensor, to catch new attacks

Hybrid detection on each sensor, for maximum protection

A hospital wants one service that monitors all its laptops and servers and sends every alert to a central platform. Which of the following does it want?

An endpoint detection and response (EDR) service

Which of the following best describes the trade-off of this tool?

Few false positives, but easier to bypass

Many false positives, but impossible to bypass

No false negatives, since it learns normal behavior

Slower than anomaly-based tools on low-power devices

AP® Cybersecurity 4.4 Detecting Attacks on Devices: Logs, IoCs and Password Attacks

1. What devices record (4.4.A)

Systems log processes and settings, login attempts, file downloads and user actions; logs help reconstruct what happened before and during an incident 4.4.A.1.
An indicator of compromise (IoC) is evidence that an adversary has compromised a device or network 4.4.A.2.
Authentication logs (auth logs) record every attempted login; analyzing them can reveal attacks 4.4.A.3.

IoC family	Where you find it	Examples
Host-based 4.4.A.4	Authentication logs, user activity logs, configuration files	Unusual files created or modified; unexpected processes or services; unauthorized configuration changes; unauthorized software installs or updates
File-based 4.4.A.5	Files on the device, usually executables	A file whose hash matches known malware; file names known to come from malware; file paths linked to malicious activity
Behavior-based 4.4.A.6	Authentication and access logs	Many failed logins; unusual login times or locations; unauthorized attempts to reach sensitive data; attempts to elevate privileges

2. Choosing device detection (4.4.B)

Criterion	What to weigh
Performance 4.4.B.1	Detection tools use memory and processing power. Anomaly-based tools use more than signature-based ones; many embedded devices cannot run any detection tool.
Cost 4.4.B.2	Enough licenses for every device. An endpoint detection and response (EDR) service from a vendor is expensive but gives unified detection with a central alert platform.
Sensitivity or criticality 4.4.B.3	Devices with sensitive data or critical services are targeted more and benefit from hybrid detection when possible.

3. Judging a device detection method (4.4.C)

Speed and performance: signature-based detection is faster, and the gap is bigger on devices with little processing power; heavy tools can slow the device 4.4.C.1.
Phase of the attack: to act on a device, the adversary has already passed physical and network controls. Catching them at the device can still protect sensitive data and critical services 4.4.C.2.
False positives versus bypass: most device tools are signature-based, with few false positives, but they are easier to bypass 4.4.C.3. Bypassing detection creates a false negative: an attack that happens without an alert. Signature-based tools miss attacks with no known signature; anomaly-based tools can catch new attacks because they look for unusual behavior instead.

4. Reading authentication logs for password attacks (4.4.D)

Attack	What the log shows
Online password attack 4.4.D.1	One user, many wrong passwords. If a hash database was compromised, reset every user’s password.
Compromised password 4.4.D.2	An authorized user logging in from an unexpected place or internet protocol (IP) address, or at an unusual time
Password spraying 4.4.D.3	Many users tried within seconds of each other, from one IP address or unusual ones
Credential stuffing 4.4.D.4	Default user:password pairs tried one after another, often from the same IP address. Pairs like admin/admin point to stuffing; many guesses against one real user’s account point to an online password attack
Offline password attack 4.4.D.5	Nothing: it happens on the adversary’s computer and cannot be detected

Now be the forensic analyst: hunt through a factory server’s authentication log.

Lock it in: memory hooks

One picture per idea. If you remember the hook, you can rebuild the details.

Three IoC familiesHost, file, behavior: what changed on the system, which file is bad, how the user is acting.
Password attack patternsOne user, many tries: guessing. Many users, one IP: spraying. Default pairs in a row: stuffing.

Common misconceptions

"A stolen password database will show up as failed logins."
Not quite. Offline attacks run on the adversary's computer and cannot be detected. If a hash database is compromised, force every user to reset their password.
"Anomaly-based detection is always best for devices."
Not quite. It uses more memory and processing power. Many devices, especially embedded ones, perform better with signature-based tools or cannot run detection tools at all.
"Password spraying looks like one account failing many times."
Not quite. That pattern is a regular online password attack. Spraying is many different users tried within seconds from one or unusual IP addresses.

Exam traps

Offline password attacks cannot be detected in logs, because they happen on the adversary's computer.
A login at an unusual time or from an unusual place can mean the password is compromised even when the login succeeds.
Most device-level tools are signature-based: few false positives, but easier for adversaries to bypass.
For sensitive or critical devices, prefer hybrid detection when possible; for weak embedded devices, signature-based or none on the device.

By the numbers

Say each list out loud, then tap to check.

3 IoC families Say them, then tap

host-based (logs and settings)
file-based (files)
behavior-based (logs)

3 criteria to choose Say them, then tap

performance
cost
sensitivity or criticality

3 factors to evaluate Say them, then tap

speed and performance
phase of the attack
false positives versus ease of bypass

4 password attack signs Say them, then tap

one user
many wrong passwords

unusual time
place or IP

many users within seconds from one IP (spraying)

default user:password pairs in quick succession (stuffing)

In 30 seconds

Devices log processes, settings, logins, downloads and user actions; authentication logs record every login attempt.
Host-based IoCs: unusual files, unexpected processes, unauthorized setting changes or installs. File-based: known malware hashes, names, paths. Behavior-based: failed logins, unusual times or places, sensitive data access, privilege escalation attempts.
Choose detection by performance, cost (licenses, EDR services) and criticality; evaluate by speed, attack phase, false positives versus bypass.
Password attacks in logs: repeated failures, odd time or place, spraying, stuffing. Offline attacks are invisible; reset every password after a database breach.

Cover this list, say the points out loud, then take the checkpoint without scrolling back up.

Time	User	Password tried	Source IP	Result
01:40:02	a.diaz	Winter2026!	198.51.100.7	failed
01:40:03	b.kim	Winter2026!	198.51.100.7	failed
01:40:04	c.osei	Winter2026!	198.51.100.7	failed
01:40:05	d.novak	Winter2026!	198.51.100.7	failed

Time	Attempt (user/password)	Source IP	Result
22:15:10	admin / admin	203.0.113.50	failed
22:15:11	admin / 12345	203.0.113.50	failed
22:15:12	root / root	203.0.113.50	failed
22:15:13	user / user	203.0.113.50	success

Time	Source IP	Location	Result
Mon 09:02	10.4.2.18	Office	success
Tue 03:20	203.0.113.88	Another country	success
Tue 03:45	203.0.113.88	Another country	success

Key terms: flip the cards

Read the term, say the definition out loud, then flip to check. Struggling a little to remember is what makes it stick.

Indicator of compromise (IoC)tap to flip

Evidence in data or traffic that a system may be under attack, such as connections to known malicious addresses or mismatched port and application traffic.
Example and CED codes
Authentication logtap to flip

A log that records every attempted login on a system, including the user, time, source and result.
Example and CED codes
Host-based IoCtap to flip

An indicator of compromise found in logs and configuration settings, such as unexpected processes or unauthorized setting changes.
Example and CED codes
File-based IoCtap to flip

An indicator of compromise found in files, such as a hash matching known malware or a known malicious file name or path.
Example and CED codes
Behavior-based IoCtap to flip

An indicator of compromise found in authentication and access logs, such as many failed logins or attempts to elevate privileges.
Example and CED codes
Endpoint detection and response (EDR)tap to flip

A vendor service that monitors an organization's devices with a unified, centralized alert platform; expensive but holistic.
Example and CED codes
Password sprayingtap to flip

An online attack that tries one common password against many different accounts.
Example and CED codes
Credential stuffingtap to flip

An attack that tries common default credentials or stolen username and password pairs on services or devices.
Example and CED codes
Offline password attacktap to flip

Cracking a captured user:password hash database on the adversary's own computer; it bypasses lockout and cannot be detected.
Example and CED codes

Questions students ask

What is an indicator of compromise (IoC)?

Evidence that an adversary has compromised a device or network, such as a file whose hash matches known malware or many failed logins.

How do you spot password spraying in an authentication log?

Many different users trying to log in within seconds of each other, from one IP address or from unusual IP addresses.

What should happen if a password hash database is stolen?

Treat every password in it as insecure and force all users to reset their passwords, because offline cracking cannot be detected.

4.4 Detecting Attacks on Devices