4.4 Detecting Attacks on Devices（检测设备攻击）

LO 4 · EK 17 ｜ 严格按大纲顺序学习

▶ 从第一个 EK 开始看课件（幻灯片，可翻页/全屏） 点击下方任意 EK 编号（如 4.4.A.1）也可直接进入对应课件页

学习目标 Learning Objectives

4.4.A Explain how to detect attacks against devices.

- [4.4.A.1](/ek/4.4.A.1) — System processes and settings, login attempts, file download attempts, and user actions are logg… - [4.4.A.2](/ek/4.4.A.2) — An indicator of compromise (IoC) is evidence that an adversary has compromised a device or netwo… - [4.4.A.3](/ek/4.4.A.3) — Authentication logs (or auth logs) record every attempted login on a system. Analysis of authent… - [4.4.A.4](/ek/4.4.A.4) — Host-based IoCs are discovered when analyzing logs and configuration settings. Indicators, such … - [4.4.A.5](/ek/4.4.A.5) — File-based IoCs are discovered when analyzing files on a device. Indicators are usually found in… - [4.4.A.6](/ek/4.4.A.6) — Behavior-based IoCs are discovered when analyzing logs. Indicators can be found in authenticatio…

4.4.B Determine controls for detecting attacks against a device.

- [4.4.B.1](/ek/4.4.B.1) — Performance is a criterion for determining a detection method. Detection tools use system memory… - [4.4.B.2](/ek/4.4.B.2) — Cost is a criterion for determining a detection method. Organizations that purchase detection so… - [4.4.B.3](/ek/4.4.B.3) — Sensitivity or criticality of the device is a criterion for determining a detection method. Devi…

4.4.C Evaluate the impact of a device detection method.

- [4.4.C.1](/ek/4.4.C.1) — Speed and performance are factors in evaluating the impact of a detection method. Signature-base… - [4.4.C.2](/ek/4.4.C.2) — Phase of the attack is a factor in evaluating the impact of a detection method. To carry out act… - [4.4.C.3](/ek/4.4.C.3) — False positives versus ease of bypassing detection is a factor in evaluating the impact of a det…

4.4.D Apply detection techniques to identify indicators of password attacks by analyzing log files.

- [4.4.D.1](/ek/4.4.D.1) — Online password attacks can be detected in authentication logs. A single user attempting many wr… - [4.4.D.2](/ek/4.4.D.2) — If an authorized user is logging in from a different location or IP address than expected, or at… - [4.4.D.3](/ek/4.4.D.3) — An indicator of password spraying is many users trying to log in within seconds of each other fr… - [4.4.D.4](/ek/4.4.D.4) — An indicator of credential stuffing is a series of default user:password combinations being atte… - [4.4.D.5](/ek/4.4.D.5) — Offline password attacks can’t be detected, because the attack takes place on the adversary’s co…

---

← 返回单元 Unit 4