Week 13.0 Analyze indicators of Malicious activities – III

Overview

The course introduces Cryptographic Attacks, where attackers attempt to break or misuse encryption, hash functions, or digital signatures. Examples include known-plaintext attacks, downgrade attacks, collision attacks, and key-recovery attempts.

Students also learn to recognize Malicious Code Indicators, such as suspicious scripts, encoded payloads, anomalies in process behavior, or unauthorized modifications to system files.

The module expands into specific Application Attacks, explaining how attackers exploit software flaws through Replay Attacks, Forgery Attacks, and Injection Attacks. A deeper look is provided into specialized forms such as Directory Traversal and Command Injection, which allow attackers to escape application restrictions and execute unauthorized commands on a server.

To support detection skills, learners examine URL Analysis, learning how to identify malicious URLs and detect obfuscation techniques. The module ends with Web Server Logs, demonstrating how log entries reveal attack attempts such as SQL injection probes, brute-force attempts, unauthorized access, and reconnaissance activities.

By completing this module, learners gain a full understanding of the threat landscape—from malware to network exploitation—building the ability to identify, analyze, and respond to attacks.