Study guide
15.2 Malicious Activity, Social Engineering, and Behavior Analytics
ISC2 Systems Security Certified Practitioner SSCP
Track your progress as you read
Finished sections get a check mark.
1 Introduction and Exam Overview
1.1 Current Exam Facts 1.2 Computerized Adaptive Testing, Scoring, and Retakes 1.3 Eligibility, Associate Pathway, Endorsement, and Maintenance
2 Ethics and Security Concepts
2.1 Comply with Codes of Ethics 2.2 Understand Security Concepts 2.3 Identify and Implement Security Controls
3 Functional Controls, Assets, and Change Management
3.1 Document and Maintain Functional Security Controls 3.2 Support and Implement the Asset Management Lifecycle 3.3 Support and Implement the Change Management Lifecycle
4 Security Awareness and Physical Security Operations
4.1 Support and Implement Security Awareness and Training 4.2 Collaborate with Physical Security Operations
5 Authentication Methods and Trust Architectures
5.1 Implement and Maintain Authentication Methods 5.2 Federated Access with OAuth2, SAML, and OpenID Connect 5.3 Understand and Support Internetwork Trust Architectures
6 Identity Lifecycle and Access Control Models
6.1 Support and Implement the Identity Management Lifecycle 6.2 Mandatory, Discretionary, and Role-Based Access Control 6.3 Rule-Based, Attribute-Based, and Privileged Access Management
7 Risk Management, Visibility, and Legal Concerns
7.1 Risk Management Concepts and Treatment 7.2 Risk Visibility, Reporting, and Threat Intelligence 7.3 Legal and Regulatory Concerns
8 Assessments, Monitoring, and Analysis
8.1 Security Assessments and Vulnerability Management 8.2 Operate and Monitor Security Platforms 8.3 Analyze Monitoring Results
9 Incident Response and Forensic Investigations
9.1 Incident Response: Preparation, Detection, Analysis, and Escalation 9.2 Containment, Eradication, Recovery, and Lessons Learned 9.3 Understand and Support Forensic Investigations
10 Business Continuity and Disaster Recovery
10.1 Business Continuity and Emergency Response 10.2 Disaster Recovery and Restoration Metrics 10.3 Backup, Redundancy, Testing, and Drills
11 Cryptography Foundations
11.1 Reasons and Requirements for Cryptography 11.2 Hashing, Salting, Symmetric, Asymmetric, and ECC 11.3 Digital Signatures, HMAC, Algorithm Strength, and Cryptanalysis
12 Secure Protocols and Public Key Infrastructure
12.1 Understand and Implement Secure Protocols 12.2 Understand Public Key Infrastructure
13 Networking Fundamentals, Attacks, and Access Controls
13.1 Understand and Apply Fundamental Concepts of Networking 13.2 Understand Network Attacks and Countermeasures 13.3 Manage Network Access Controls
14 Network Security Operations, Wireless, and IoT
14.1 Manage Network Security 14.2 Operate and Configure Network-Based Security Appliances and Services 14.3 Secure Wireless Communications 14.4 Secure and Monitor Internet of Things
15 Malware, Malicious Activity, and Endpoint Security
15.1 Identify and Analyze Malicious Code 15.2 Malicious Activity, Social Engineering, and Behavior Analytics 15.3 Implement and Operate Endpoint Device Security
16 Mobile, Cloud, and Virtual Environments
16.1 Administer and Manage Mobile Devices 16.2 Cloud Security: Deployment, Service Models, and Shared Responsibility 16.3 Cloud Legal, Regulatory, and Third-Party Requirements 16.4 Operate and Maintain Secure Virtual Environments
15.2 Malicious Activity, Social Engineering, and Behavior Analytics
Key Takeaways Explain This Topic AI
SSCP 7.1 malicious activity includes insider threat, data theft, distributed denial of service, botnets, zero-day exploits, web-based attacks, and advanced persistent threats — name the activity the stem describes, not a malware brand.
Outline countermeasures are user awareness and training, system hardening, patching, isolation, and data loss prevention; match the control to the activity.
Social engineering methods on the outline are SPAM, phishing, smishing, vishing, impersonation, scarcity, and whaling. Whaling is phishing aimed at a senior executive or other high-value target.
An urgent CEO-to-CFO wire request is whaling built from impersonation and scarcity; out-of-band verification and finance training beat a disk scanner that reports clean.
Behavior analytics uses machine learning, artificial intelligence, and data analytics to flag baseline deviations (impossible travel, mass download, new process lineage) even when no malware signature exists.
Last updated: August 2026
Malicious activity is more than a malware family
Knowledge area 7.1 continues past malware into types of malicious activity , malicious activity countermeasures , social engineering methods , and behavior analytics . The CAT will mix these. A whaling email that tricks a chief financial officer into a wire is malicious activity even if no binary ever ran. An advanced persistent threat (APT) may use fileless malware and stolen credentials and a zero-day. Your job is to name the activity the stem actually describes and pick a countermeasure from the outline's list: user awareness/training , system hardening , patching , isolation , and data loss prevention (DLP) .
Types of malicious activity
Activity What it is SSCP tell Typical countermeasure mix
Insider threat Malicious or negligent person with legitimate access Unusual access to shares the role does not need; copy-out after a resignation Least privilege, DLP, monitoring, awareness — not "more antivirus"
Data theft Unauthorized exfiltration Large cloud uploads, DNS tunneling, email to personal accounts DLP on egress, encryption, isolation of sensitive segments
Distributed denial of service (DDoS) Overwhelming availability from many sources Site or virtual private network unusable; volumetric, protocol, or application-layer floods Provider scrubbing is Domain 6; here you also kill any botnet you host and harden exposed apps
Botnet Compromised devices under command and control Outbound C2, spam relay, crypto-mining, being used in someone else's DDoS Isolation, remediation of zombies, block C2, patch the hole
Zero-day exploits Attacks using a vulnerability with no vendor patch yet Exploit kit or implant on software that is fully current Isolation, virtual patching, hardening, detection of behavior — not "wait for Tuesday"
Web-based attacks Browser and application attacks: cross-site scripting, SQL injection, drive-by, watering hole, malvertising Compromised content management system, malicious ad, stolen session cookie Patching, browser isolation, allowlisting, application-layer filtering
Advanced persistent threat (APT) Skilled, targeted, long-dwell adversary Months of living-off-the-land, credential reuse, slow staging of data Isolation of identities and hosts, hunting, DLP, hardening, patching — not a single antivirus clean
Insider threat is not automatically "the employee is evil." A claims analyst who emails a spreadsheet of members to a personal mailbox because the virtual private network is slow is still data theft. A sysadmin who plants a trapdoor before being fired is a malicious insider. Controls differ (DLP and training versus immediate account revocation and forensics), but both are 7.1 activity types.
Botnet versus DDoS. A botnet is a fleet . DDoS is one mission that fleet might fly. Your endpoints can be victims of DDoS, members of a botnet, or both. Cleaning a miner that phones home to a C2 server is botnet remediation. Absorbing a flood at the provider is DDoS response and sits primarily with Domain 6 network countermeasures. Do not mix those on the exam.
Zero-day means the vendor does not have a patch, not "we forgot last month's cumulative update." Last month's missing update is a known vulnerability. Zero-day countermeasures are isolation, attack-surface reduction, and detection of behavior ( behavior analytics , EDR), because signatures will not exist yet.
APT is about persistence and objectives, not a specific malware brand. Nine months of valid administrator tools, stolen tickets, and quiet cloud copies is APT-style activity even if every file hash is a vendor binary.
Malicious activity countermeasures
The outline's list is short on purpose. Use it.
Countermeasure Operations meaning When it is the best answer
User awareness / training Phishing simulations, reporting buttons, payment-callback policy, insider reporting Social engineering, negligent insiders, "the chief executive said to wire this"
System hardening Secure configuration baselines, disable unused services and macros, remove local admin Worms, unused remote services, living-off-the-land abuse
Patching Operating system, application, firmware, and browser updates on a measured service level Worms exploiting published vulnerabilities, most content-management compromises
Isolation Network segmentation, sandbox, EDR isolate, disable account, quarantine VLAN Outbreaks, zero-days, APT footholds, infected kiosks
Data loss prevention (DLP) Monitor or block sensitive data at rest, in motion, and in use Data theft, insider exfil, misdirected email, unsanctioned cloud sync
Scenario (insider and DLP). A claims analyst's last day is Friday. On Thursday night, DLP alerts on thousands of member records copied to a personal cloud drive. Isolation here is: disable the account and the endpoint, revoke tokens, and hold the laptop. Awareness training would not have stopped a determined thief, but DLP, blocked personal sync, and timely deprovisioning reduce the blast radius. Hardening (no local admin, blocked removable media) makes the copy harder.
Patching without isolation during an active worm is how you patch hosts that are already encrypting their neighbors. Isolation without later patching is how the next unpatched laptop reconstitutes the botnet.
Social engineering methods
Social engineering attacks people so that malware and fraudulent payments do not need a zero-day. The outline's examples are SPAM email , phishing / smishing / vishing , impersonation , scarcity , and whaling .
Method Channel and trick SSCP tell
SPAM Unsolicited bulk email (and similar bulk noise on other channels) Scams and malware lures in volume; filtered and reported; not by itself "the executive wire"
Phishing Fraudulent message that impersonates a trusted party to steal credentials or deliver malware Fake login page, password-reset lure, malicious attachment
- Smishing Phishing via Short Message Service Package-delivery texts, "your multi-factor is locked," short links
- Vishing Phishing via voice Fake help desk or bank calls asking for one-time passwords
Impersonation Pretending to be a person or role, in person, email, or phone "IT" at the desk with a laptop; lookalike executive mail
Scarcity Time pressure: offer ending, account closing, executive in the air and unreachable The urgency is the payload; slow the process
Whaling Phishing aimed at senior executives or other high-value targets Chief financial officer, chief executive, general counsel — usually a payment, tax-form dump, or identity-tenant credential
Phishing, smishing, and vishing are the same idea on three channels (email, SMS, voice). Whaling is about who is targeted, not a fourth radio. A whale still sees scarcity, impersonation, and a lookalike domain.
Whaling the CFO wire
Scenario. You support a mid-size manufacturer. At 16:40 on a Thursday, the chief financial officer (CFO) receives mail that appears to come from the chief executive officer (CEO) : new overseas tooling vendor, wire 180,000 dollars before the banks close, "I am in the board meeting, do not call, this is confidential." The display name is right; the sending domain is a lookalike. No malware attachment.
This is whaling built from impersonation plus scarcity . It is not a zero-day against the mail server. It is not ordinary SPAM . Running a scanner on the CFO laptop will report clean and the organization can still lose the wire.
Operational controls:
Awareness and training for finance and executives: no wire or gift-card request from email alone. Callback to a number already on file, not the number in the message.
Dual-control and out-of-band verification in the payment procedure. When the stem is social engineering, that procedure is the awareness/training countermeasure the outline wants, not a new antivirus product.
Technical assists: external-mail banners, lookalike-domain detection, DLP or hold on first-time vendor payments. Those assists do not replace the callback.
If the CFO already submitted credentials to a lookalike site, isolate the identity (reset password, revoke sessions, inspect mailbox rules) as well as coach the human. Social engineering and account takeover often arrive together.
Exam traps. Calling every bulk nuisance message whaling. Calling a CEO-targeted wire a DDoS. Skipping isolation of a compromised mailbox after a phish because "it was only social engineering." Claiming behavior analytics makes awareness training obsolete.
Behavior analytics: machine learning, AI, and data analytics
The outline explicitly lists behavior analytics with machine learning (ML) , artificial intelligence (AI) , and data analytics . This is how you catch APT operators, insiders, and fileless activity that signatures miss.
User and entity behavior analytics (UEBA) builds a baseline: this claims analyst maps two shares at 09:00 from the office virtual LAN; this service account never talks to the internet; this domain admin does not use PowerShell at 02:00 from a virtual private network in another country. Data analytics correlating identity logs, EDR process trees, DLP events, and traffic volumes turns those streams into an event of interest. ML and AI in modern security information and event management (SIEM) and EDR products score anomalies — impossible travel, mass download, new process lineage.
What behavior analytics is not :
Proof of guilt. A 02:00 mass download from finance shares is an investigation, not an automatic termination.
A replacement for patching, hardening, isolation, DLP, or training. Models miss novel slow APTs and generate noise if the baseline is wrong (a newly hired contractor who should touch those shares).
Magic attribution. "The model named a nation-state" is not an SSCP answer. You isolate, hunt, and document facts.
Scenario continued. UEBA flags the CFO account authenticating from a new country twelve minutes after the whaling mail, then creating a mailbox forwarding rule. No malware hash exists. Behavior analytics plus isolation of that identity is the 7.1 response. Reimaging the laptop without revoking the cloud session leaves the attacker in the mailbox.
When the CAT stem gives you months of dwell time, answer APT and a mix of isolation, DLP, hardening, and patching. When it gives you a CEO-to-CFO urgent wire, answer whaling and awareness plus out-of-band verification. When it gives you a flood of traffic, separate DDoS from the botnet that may be causing it. When it gives you a baseline deviation without a signature, answer behavior analytics — then still investigate before you declare an insider.