TechKnowSurge
TechKnowSurge Catalog Videos Resource Consumption
VideoSecurityFree

Resource Consumption

Unusual resource consumption—including spikes or drops in CPU, memory, bandwidth, or storage—can signal a compromise and warrants investigation. Monitoring these metrics across devices and network infrastructure helps identify patterns that fall outside normal operating parameters.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Unusual resource consumption is a recognized indicator of compromise that security professionals use to detect malicious activity on endpoints and network infrastructure. Relevant metrics include CPU utilization, memory usage, network bandwidth, and storage capacity—and the anomaly can manifest as consumption that is unexpectedly high, unexpectedly low, or simply inconsistent with established baselines. Any deviation from normal operating parameters is reason enough to investigate further. Malware behavior often surfaces through these resource signals. A worm, for instance, continuously replicates itself and can exhaust local storage through repeated self-copying, or consume significant bandwidth as it propagates to other systems across the network. Irregular spikes in outbound data may indicate exfiltration in progress, while periodic, patterned traffic anomalies can reveal command-and-control communication between an infected host and an adversary's infrastructure. Effective detection relies on continuous monitoring of devices, network equipment, and internet-facing links to establish what normal consumption looks like and identify deviations as they occur. Tools like Windows Performance Monitor provide visibility into CPU and memory activity in real time. A single spike is not necessarily cause for alarm, but recurring patterns, unexpected timing, or behavior inconsistent with a system's typical workload are all signals that merit deeper investigation.

What you'll learn

What's covered

Resource Consumption IOCs

Key terms

Indicators of Compromise
IoC
Indicators of Compromise are forensic artifacts such as file hashes, IP addresses, domain names, and registry keys that provide evidence a system may have been compromised, enabling threat detection and intelligence sharing.
Resource Consumption
The utilization of system or network resources such as CPU, memory, bandwidth, and storage, which when abnormal can signal a security incident.
Bandwidth
The maximum rate of data transfer across a network path, typically measured in bits per second.
Worm
Self-replicating malware that spreads across networks without requiring user interaction.
Data Exfiltration
The unauthorized transfer of data from a system to an external destination.
Baseline
A documented set of minimum security standards or performance metrics used as a reference point.

Topics

Resource Consumption Indicators Of Compromise Malware Analysis Threat Detection Network Monitoring Cybersecurity

Transcript

Another indicator of compromise could be resource consumption. What are the resources doing on these machines? I've seen resource consumption go really crazy on machines or network devices when there's some sort of indicator of compromise.

The resources that we're talking about could be the CPU, if it's really like a spiked CPU, or we see that the memory is filling up, or if there's a lot of bandwidth, or maybe there's very little bandwidth, or the storage. If we see any of these that are really outside the regular operating parameters, then this might be something that we want to look into.

A Worm as an Example

A great example of this is a worm. A worm is malware that can infect a computer and cause harm on a computer. The goal of a worm is to replicate itself, and so since it's replicating itself, it could possibly fill up the storage, because it keeps making copies of itself. Or maybe it's the bandwidth — it could fill up the bandwidth as it makes its copies in other locations on other parts of the network.

Anything Out of the Bounds of Normal

It doesn't have to just be an increase in consumption. It could be low consumption, it could be high consumption, it could be inconsistent or consistent. Anything that's happening that's out of the bounds of normal could be a flag that there's an indicator of compromise.

An example might be that we see these little spikes in data here. Maybe there's some sort of data exfiltration that's happening here, that data is being shipped off. Or maybe it's a command and control and there's some sort of communication that's happening with the adversary. So we need to look for inconsistencies there.

Monitoring

One thing we could do is monitor our devices and network equipment. We could monitor our links that are happening on here, the internet connection. Anything on our network, within our infrastructure, we could monitor to see if there's inconsistencies in the resource consumption of these devices.

I'm on a Windows server box, and what I'm doing is I'm looking at the performance monitor. This is showing the CPU and memory, and we see a spike right here. Now, computers usually have spikes, so this might not be that big of a concern. But maybe there's just some irregular patterns, and this is not used to having spikes on here. Or maybe there is some sort of pattern with the spike that we want to research further into.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →