Indicator of Attack or of Compromise?

About this interactive

An indicator is a sign. The lesson separates two kinds. An indicator of attack shows someone trying. Its example is a machine where somebody keeps trying usernames and passwords: an attack is under way, but nothing is compromised until they succeed. Account lockouts, port scans and blocked exploit attempts are signs of the same kind. An indicator of compromise shows the attacker is already in, or that something has been taken over. One account signed in from the United States and then from Asia ten minutes later (impossible travel), the same user logged in twice at once, a browser hijacked into blocking content, and security logs deleted to cover tracks all mean something has already gone wrong. Attack comes first; compromise follows if it works. In practice, as the lesson says, both are usually just called indicators of compromise, and Security+ lists them together. Telling them apart tells you how urgent the response is.

What you'll learn

Tell an indicator of attack, a sign that someone is trying to get in, from an indicator of compromise, a sign that something has already been compromised
Recognize common indicators from the lesson, such as account lockouts, impossible travel, concurrent sessions, blocked content and missing logs, and say which kind each one is

Aligned to

CompTIA Security+

2.4 Given a scenario, analyze indicators of malicious activity.

4.4 Explain security alerting and monitoring concepts and tools.

CompTIA CySA+

1.2 Given a scenario, analyze indicators of potentially malicious activity.

ISC2 CISSP

7.7 Operate and maintain detection and preventative measures.

NIST CSF

DE.CM-03 Personnel activity and technology usage are monitored to find potentially adverse events.

Key terms

Indicators of Compromise: Indicators of Compromise are forensic artifacts such as file hashes, IP addresses, domain names, and registry keys that provide evidence a system may have been compromised, enabling threat detection and intelligence sharing.
Impossible Travel: A security alert triggered when account logins occur from geographically distant locations within a timeframe that makes physical travel impossible, indicating potential unauthorized access.
Concurrent Logins: Multiple simultaneous sessions under the same user account, which may indicate unauthorized access or account sharing by a threat actor.
Brute Force Attack: An attack method that systematically tries all possible combinations of passwords or keys until the correct one is found.
Account Lockout: A security control that disables a user account after a defined number of failed login attempts to prevent unauthorized access.

Topics

Indicators Of Compromise Monitoring Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →