CND (312-38) Network Defense Simulation

Learn to differentiate between proactive threat indicators and reactive breach data. This simulation focuses on identifying attacker intent and sequential actions before a successful compromise.

Network Scenario

You are a Network Security Analyst monitoring the perimeter firewall, WAF, and IDS for an enterprise network. Over the last 90 minutes, your SIEM has aggregated a sequence of low-level alerts originating from a single external IP address targeting your DMZ.

No endpoints have reported malware execution, and there is no evidence of data exfiltration or unauthorized access. However, the structured sequence of activities indicates a methodical approach toward a specific objective.

Traffic & Logs

[14:02:11] FW-EXT-01 : DROP : TCP SYN scan detected from 203.0.113.45 to DMZ_Subnet (Ports 1-1024)

[14:18:44] WAF-01 : ALERT : SQL Injection syntax probing detected in HTTP GET requests (Target: /login.php)

[14:25:09] IDS-01 : ALERT : Potential directory traversal attempts (Target: /api/v1/download?file=../../)

[14:40:12] FW-EXT-01 : DROP : Repeated SSH brute-force attempts on DMZ_Jump_Server (Port 2222)

Question

Which of the following indicators are discovered through an attacker’s intent, their end goal or purpose, and a series of actions that they must take before being able to successfully launch an attack?

Indicators of compromise

Incorrect. Indicators of Compromise (IoC) represent artifacts that a breach has already occurred (e.g., malware hashes, known bad IPs communicating with C2 servers, altered system files).

Key risk indicators

Incorrect. Key Risk Indicators (KRI) are metrics used by management to measure the organization's overall risk exposure and likelihood of a risk event materializing, not specific attacker behaviors.

Indicators of exposure

Incorrect. Indicators of Exposure (IoE) identify vulnerabilities, misconfigurations, or exposed assets (e.g., missing patches, open RDP to the internet). They show you are vulnerable, not that an attacker has active intent.

Indicators of attack

Correct! Indicators of Attack (IoA) focus on the behavior and intent of the attacker. By observing the sequence of actions (scanning, probing, brute-forcing), defenders can identify and block an attack before it results in a compromise.

Analyst Hint: Look at the timeline of the logs. The attacker is actively probing, scanning, and testing inputs. They have a goal, but they haven't achieved it yet. What term describes this *active* phase before a breach?

Expert Analysis

1. What is happening in the network

The logs depict a threat actor actively mapping the external perimeter. They initiated a TCP SYN scan to find open ports, followed by application-layer probing (SQLi and Directory Traversal against the web infrastructure), and finally attempted brute-force access on an alternative SSH port. No payload has executed inside the network, meaning a compromise has not yet occurred.

2. Identify attack or behavior

This is the Weaponization and Delivery/Exploitation phase of an attack lifecycle. The traffic represents proactive behavior—a sequence of required steps an attacker must take to find a viable entry point.

3. Why the correct answer is correct (IoA)

Indicators of Attack (IoAs) shift the focus from "what is the signature of the malware?" to "what is the behavior of the attacker?". Recognizing intent—such as an external IP sequentially triggering port scans, WAF alerts, and auth failures—allows the Blue Team to dynamically block the IP before a successful exploit is found.

4. Why others are wrong

IoC (Compromise): Too late. You look for IoCs (like a specific MD5 hash or a beaconing domain) after you suspect an endpoint is infected.
IoE (Exposure): Static. An IoE is an open AWS bucket or unpatched server. It doesn't tell you someone is actively attacking it right now.
KRI (Risk): Business level. A KRI might be "Percentage of critical servers missing patches older than 30 days."

5. Defensive action

As a Network Defender, identifying this IoA should trigger an automated or manual response to block the source IP (`203.0.113.45`) at the perimeter edge firewall or WAF, thwarting their intent before they discover an exploitable vulnerability.

6. MINI LESSON: Detection vs Prevention

IoC = Reactive Detection: Relying purely on IoCs means you are waiting for patient zero to get infected to harvest the bad hashes/IPs.
IoA = Proactive Prevention: By understanding the sequence of actions an attacker must take (Reconnaissance -> Enumeration -> Initial Access), you can build correlation rules in your SIEM to alert on the behavior chain, stopping the attack in progress.

Master Network Defense Concepts

Practice more scenarios covering firewalls, IDS/IPS, traffic analysis, and threat intelligence.

Explore more CND simulations