Once an attack passes the Installation phase, it moves into a new phase where the attack is controlled (sometimes autonomously) and the Attack Objectives are played out.

While it doesn’t sound promising at this point, we can still interrupt the attack and prevent it from being successful. While many attacks are silent and require technical detections to find them, equally, many attacks cause computer systems to misbehave and go “haywire”. Knowing what the normal behaviour of your computer is (this is called a “baseline”) helps you identify when a computer’s behaviour is not normal.

By being ready to speak up when things really play up (chances are it’s not an attack but...), if you’re the one who calls out a cybersecurity attack, then you might have prevented a successful attack in the final stages. This might be the only time we disagree with the story of the Boy who cried Wolf.

Questions you can ask that could alert you to a reportable CyberSecurity Attack in the Command and Control phase:

1. Report unusual computer behavior immediately

Computer acting sluggish or freezing frequently?
Programs opening or closing on their own?
Mouse moving by itself or keyboard typing without you?
Files appearing, disappearing, or changing?

2. Watch for unexpected network activity

Pop-ups or notifications about programs trying to access the internet that you don't recognize?
Firewall warnings about unknown applications trying to communicate?
Don't just click "Allow" to make it go away - report it

3. Notice strange outgoing communications

Emails sent from your account that you didn't send?
Messages to contacts you didn't write?
Social media posts you didn't make? Your account might be compromised and being used to communicate with attackers

4. Be alert to odd system changes

New programs, toolbars, or icons you didn't install?
Security software disabled or not working?
Settings changed without your knowledge?
New user accounts appearing on your computer?

5. Watch for unusual after-hours activity

Getting locked out of systems because "someone else is logged in"?
Notifications of logins from strange locations or times? - This could indicate attackers are using your credentials when you're not around.

Lesson 5. Command and Control and Actions on Objectives