TechKnowSurge

VideoSecurityFree

Unauthorized Changes

Unauthorized changes to a network or system—whether to files, accounts, processes, scheduled tasks, or permissions—are key indicators of an active attack. Recognizing these changes early is critical to detecting and responding to threats before they cause serious damage.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Unauthorized changes to a system or network are among the most reliable indicators that an attack is underway. Adversaries with access to an environment routinely modify it to maintain control, expand their reach, or conceal their presence. These modifications can span a wide range: hardware additions or removals, new or altered software installations, unfamiliar running processes or startup services, unexpected user accounts, changed file permissions, and activity on ports that were previously inactive. Even something as easy to overlook as an unexplained desktop icon can signal that unauthorized activity has occurred on a machine. One particularly stealthy technique involves abusing the operating system's task scheduler. Attackers may create scheduled tasks that execute commands on a recurring basis or in response to specific triggers, giving them persistent access even if their primary foothold is discovered and removed. For example, a scheduled task could be configured to automatically recreate a deleted account, ensuring the attacker retains access despite remediation efforts. Similarly, unauthorized changes to file and folder permissions—such as new users appearing in a security tab—can indicate that an attacker is quietly expanding their access rights within the system. Effective security monitoring depends on establishing a clear baseline of normal system behavior and continuously watching for deviations. Changes to accounts, registries, scheduled tasks, running services, and file permissions should all be treated as potential threat indicators until verified as legitimate. Building the habit of investigating even minor or seemingly benign anomalies is essential to catching attacks early and limiting their impact.

What you'll learn

Identify unauthorized changes to hardware, software, accounts, scheduled tasks, file permissions, and system configurations as indicators of an active attack
Explain how adversaries use mechanisms such as the Windows Task Scheduler to establish persistence on a compromised system

What's covered

Indicators of Attack

Unauthorized Changes
- Hardware Added/Removed
- Software Changes
- File & Permission Changes
- Registry Modifications
Account & Process Activity
- Accounts Created/Deleted
- Running Processes/Services
- Command Execution
- Privilege & Port Changes
Scheduled Tasks
- Adversary Installs New Task
- Maintains Persistence
- Recreates Deleted Accounts
Real-World Examples
- Unexplained Desktop Icon
- Task Scheduler Manipulation
- File Security Tab Changes

Key terms

Persistence: A MITRE ATT&CK tactic in which an adversary maintains their foothold within a compromised network to survive restarts, credential changes, or other interruptions.
Backdoor: A hidden method of bypassing normal authentication or security controls to gain unauthorized access.
Privilege Escalation: An attack that exploits vulnerabilities to gain higher-level access than originally authorized.
Baseline: A documented set of minimum security standards or performance metrics used as a reference point.
Configuration Management: The process of tracking and controlling changes to hardware, software, and documentation throughout a system's lifecycle.
Scheduled Task: A persistence technique in which an adversary configures the operating system to automatically execute malicious code at specified times or trigger events.

Topics

Threat Detection Indicators Of Compromise Persistence Mechanisms Windows Task Scheduler System Hardening Incident Response Cybersecurity

Transcript

Unauthorized Changes as an Indicator

If an adversary is on a network, there's a good chance they're going to be making changes on that network. So this is an indicator of an attack: any kind of unauthorized changes.

This really could be any type of change. Whether they're deleting something, adding something, or just changing or editing something, that could be an indicator. It could be some sort of hardware that gets added or removed. It could be software. It could be processes that are running on the machine. It could be services that run during the startup of a machine. It could be icons that appear on the desktop, or anywhere else. It could be accounts that get created or deleted. It could be command execution that happens on the machine. It could be scheduled tasks. It could be privileges, ports that show up on the machine or start communicating on the machine. It could be part of the registry. It could be any kind of files that show up on there, or any kind of permission changes.

Examples

Here's an example. I have this buy now link. Well, where did this buy now link come from? Maybe I didn't install this on the machine or set it up on the machine, and so this is an unexplained link. The regular user is just going to throw it away and probably not going to pay much attention to it and just kind of scratch their head, but it could be an indicator that something's happening on the machine.

Here's the task scheduler on the machine. The task scheduler has a bunch of tasks that it can run on some sort of recurring basis or some sort of trigger. One thing that an adversary might do is they might install a new task to run so that way they have accessibility to this machine. For instance, maybe they want to guard against if somebody were to delete the account that they have access to this machine — then this task scheduler would see that and then recreate that account, or do something on the machine that gives them some sort of persistence. So they can use the task scheduler as a sneaky way to execute certain commands whenever they want.

Here's the security tab of a file, and this file has certain users. If we suddenly start seeing users being deleted or added, or some sort of permission changes on here, it could be some sort of indicator that there is an attack going on.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →