EC-Council CSA · Domain 2 of 8

EC-Council CSA Domain 2: Understanding Cyber Threats, IoCs, and Attack Methodology

Worth 8% of CSA v2, this domain teaches the attacks a SOC analyst must recognize: network, host, application, social engineering, email and insider TTPs, the indicators each leaves behind, and the frameworks used to describe attacker behavior.

Exam weight
8%
Official objectives
9
Estimated questions estimate
~8
Suggested study time estimate
6–9 hrs

About 14 min read Reviewed October 2026

Overview

Domain 2 is the threat knowledge a SOC analyst brings to every alert. It begins with cyber threats and their impact, then works through attack tactics, techniques and procedures by target. Network attacks include scanning, denial of service, spoofing, sniffing and man-in-the-middle. Host attacks include password cracking, privilege escalation, malware execution and persistence. Application attacks cover SQL injection, cross-site scripting, cross-site request forgery, command injection and directory traversal. The domain also covers social engineering such as phishing, vishing and pretexting, email attacks such as spoofing and business email compromise, and malicious, negligent or compromised insiders.

The second half moves from attacks to evidence. You must recognize indicators of compromise for each attack type and understand attack methodology and frameworks, chiefly the Cyber Kill Chain, MITRE ATT&CK, the Diamond Model and the Pyramid of Pain.

How it's tested

Expect evidence-first questions. A stem shows a log entry, URL, email header detail or host observation, and you identify the attack type, the indicator category or the framework stage. Some questions test framework vocabulary directly, such as which Kill Chain phase or which level of the Pyramid of Pain an item belongs to.

  • Name the attack from evidence

    A request string, log pattern or behavior is shown, and you identify the attack such as SQL injection, ARP spoofing or brute force.

  • Classify the indicator

    An artifact such as a hash, domain or registry change is given, and you decide what kind of IoC it is and how durable it is.

  • Place it in a framework

    An attacker action is described, and you map it to a Kill Chain phase or an ATT&CK tactic.

Reasoning it through

A web log shows a GET request containing ' OR 1=1-- in the id parameter, followed by a 200 response with an unusually large body. Cross-site scripting is a distractor because both attacks arrive in parameters. However, the quote and boolean condition target the database query, and the oversized response suggests extra rows were returned. That pattern is SQL injection.

Objectives 9

Official objectives from the EC-Council outline, in outline order.

2.1 Understand Cyber threats and its impact on Cyber SecurityThreat categories, actors and the damage they cause.
What it means
A cyber threat is any potential event or actor that could exploit a vulnerability to harm confidentiality, integrity or availability. Threat actors range from script kiddies and hacktivists to organized criminals, insiders and nation-state groups.
What to understand
Impact is measured as financial loss, operational disruption, data exposure, legal penalties and reputational harm. Threat, vulnerability and risk are distinct: risk combines the likelihood of a threat exploiting a vulnerability with the impact. Motive, capability and opportunity explain why particular actors target particular organizations.
How it shows up
Questions ask you to separate threat, vulnerability and risk, or to identify an actor type from its motive.
Common confusion
Using threat and vulnerability interchangeably; a vulnerability is a weakness, a threat is what exploits it.
2.2 Understand Network Attack Tactics, Techniques, and Procedures (TTPs)Attacks against network protocols and infrastructure.
What it means
Network TTPs include reconnaissance scans, sniffing, ARP and DNS spoofing, man-in-the-middle, session hijacking, denial of service and distributed denial of service, and attacks on network devices.
What to understand
Each attack leaves distinct traffic signs. A SYN flood shows many half-open connections, a port scan shows one source touching many ports, ARP spoofing shows one MAC claiming several IP addresses, and DNS poisoning shows unexpected resolution results. Volumetric DDoS saturates bandwidth, while application-layer floods exhaust server resources with valid-looking requests.
How it shows up
A traffic description or firewall log pattern is given, and you name the network attack.
Common confusion
Confusing a port scan, one host probing many ports, with a sweep, many hosts probed on one port.
2.3 Understand Host Attack Tactics, Techniques, and Procedures (TTPs)Attacks that compromise endpoints and servers.
What it means
Host TTPs are the ways attackers gain, extend and keep control of an individual system, including password attacks, privilege escalation, malware execution, persistence mechanisms, defense evasion and credential dumping.
What to understand
Password attacks include brute force, dictionary, password spraying and credential stuffing. Persistence often uses scheduled tasks, services, Run registry keys or startup folders. Credential dumping targets LSASS memory or the SAM database. Attackers clear event logs or disable security tools to evade defenses, which itself is a strong indicator.
How it shows up
Host artifacts such as a new service or cleared log are described, and you identify the technique.
Common confusion
Calling password spraying a brute force attack; spraying tries one password across many accounts to avoid lockouts.
2.4 Understand Application Attack Tactics, techniques, and Procedures (TTPs)Attacks on web and application logic.
What it means
Application TTPs exploit weaknesses in how software handles input, sessions and access, such as SQL injection, cross-site scripting, cross-site request forgery, command injection, directory traversal, file inclusion and broken authentication.
What to understand
Analysts recognize these mainly from web server and WAF logs. SQL injection uses quotes, UNION and comment sequences; XSS carries script tags or event handlers; traversal uses ../ sequences toward files like /etc/passwd; command injection adds shell separators such as ; or |. Many 404 responses in a short period suggest automated scanning.
How it shows up
A URL or request body is shown, and you identify the application attack.
Common confusion
Mixing up XSS, which targets other users' browsers, with CSRF, which abuses an authenticated user's session to send requests.
2.5 Understand Social Engineering Attack Tactics, Techniques, and Procedures (TTPs)Manipulating people rather than technology.
What it means
Social engineering persuades people to reveal information or take harmful actions. Techniques include phishing, spear phishing, whaling, vishing, smishing, pretexting, baiting, quid pro quo, tailgating and impersonation.
What to understand
These attacks exploit trust, urgency, authority and curiosity. Spear phishing targets specific people with tailored content, whaling targets executives, and pretexting relies on an invented scenario. A SOC usually sees them through user reports, email gateway alerts or follow-on activity such as an unusual login after a credential harvest.
How it shows up
A described approach is given, and you name the specific social engineering technique.
Common confusion
Treating all email lures as generic phishing when the clues show spear phishing or whaling.
2.6 Understand Email Attack Tactics, Techniques, and Procedures (TTPs)Threats delivered through email systems.
What it means
Email TTPs include sender spoofing, malicious attachments, credential harvesting links, business email compromise, display-name deception, lookalike domains and mail bombing.
What to understand
Email authentication controls help: SPF lists authorized sending servers, DKIM signs messages so tampering is detectable, and DMARC tells receivers how to handle failures and sends reports. Business email compromise often has no malware at all and relies on a convincing request for payment or data, sometimes from a genuinely compromised mailbox.
How it shows up
You may need to read authentication results or spot BEC from a described payment request.
Common confusion
Assuming a message passing SPF is safe; attackers send from domains they control, which pass SPF.
2.7 Understand Insider Attack Tactics, Techniques, and Procedures (TTPs)Threats from people with legitimate access.
What it means
Insider threats come from employees, contractors or partners who misuse authorized access. They are usually grouped as malicious insiders, negligent insiders, and compromised insiders whose accounts are controlled by an outside attacker.
What to understand
Typical signs include access outside normal hours or job role, bulk downloads, use of removable media or personal cloud storage, privilege requests without reason, and activity just before resignation. Because insiders use valid credentials, detection relies on behavior baselines and user and entity behavior analytics rather than signatures.
How it shows up
A user's behavior is described, and you identify the insider type or the best detection approach.
Common confusion
Classifying a compromised account as a malicious insider; the person is a victim and the actor is external.
2.8 Understand and Recognize the Indicators of Compromise (IoCs) of Various AttacksArtifacts that show an attack has occurred.
What it means
Indicators of compromise are observable artifacts showing a system may have been breached, such as malicious file hashes, IP addresses, domains, URLs, registry changes, unusual processes and abnormal traffic.
What to understand
IoCs are often grouped as atomic (an IP or domain), computed (a hash) and behavioral (a pattern of actions). Indicators of attack focus on intent and activity in progress rather than artifacts after the fact. The Pyramid of Pain ranks indicators by how costly they are for an attacker to change, from hashes at the bottom to TTPs at the top.
How it shows up
An artifact is listed, and you classify it or judge how durable it is for detection.
Common confusion
Assuming blocking a file hash stops an attacker for long; hashes change with trivial modification.
2.9 Understanding Attack Methodology and FrameworksModels that describe attacks as stages or behaviors.
What it means
Attack frameworks give a shared language for attacker behavior. The Cyber Kill Chain describes seven stages from reconnaissance to actions on objectives, MITRE ATT&CK catalogs tactics and techniques, and the Diamond Model links adversary, capability, infrastructure and victim.
What to understand
The Kill Chain is linear and helps decide where to break an attack early. ATT&CK is a matrix where tactics are goals, such as persistence or lateral movement, and techniques are how they are achieved; analysts use it to map detection coverage. The Diamond Model supports pivoting from one known element to related ones during analysis.
How it shows up
An activity is described, and you map it to a Kill Chain stage or ATT&CK tactic, or pick the right framework for a purpose.
Common confusion
Calling an ATT&CK technique a tactic; tactics are the attacker's why, techniques the how.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • TTPs

    Tactics, techniques and procedures describing how attackers operate.

    Remember
    Hardest indicators for an attacker to change.
    Tested as
    Framework and hunting questions.
    Trap
    Treating a tool name as a TTP.

  • Indicator of compromise

    An artifact suggesting a breach already occurred.

    Remember
    Retrospective evidence such as hashes and domains.
    Tested as
    IoC classification questions.
    Trap
    Confusing it with an indicator of attack.

  • Indicator of attack

    Signs of attacker activity or intent in progress.

    Remember
    Focuses on behavior, not static artifacts.
    Tested as
    Detection approach questions.
    Trap
    Treating it as a list of hashes.

  • Pyramid of Pain

    Ranks indicators by the pain caused to attackers when defenders use them.

    Remember
    Hash values at the base, TTPs at the peak.
    Tested as
    Indicator value questions.
    Trap
    Ranking IP addresses above TTPs.

  • Cyber Kill Chain

    Lockheed Martin's seven-stage intrusion model, running from reconnaissance through C2 to actions on objectives.

    Remember
    Earlier disruption costs the attacker more.
    Tested as
    Stage mapping questions.
    Trap
    Placing delivery after exploitation.

  • MITRE ATT&CK

    Knowledge base of adversary tactics and techniques from real observations.

    Remember
    Used to map detection coverage.
    Tested as
    Tactic versus technique questions.
    Trap
    Treating it as a linear sequence.

  • Diamond Model

    Adversary, capability, infrastructure and victim linked by an intrusion event.

    Remember
    Supports pivoting between related elements.
    Tested as
    Framework selection questions.
    Trap
    Confusing it with the Kill Chain.

  • Password spraying

    One or a few common passwords tried against many accounts.

    Remember
    Avoids per-account lockout.
    Tested as
    Authentication log questions.
    Trap
    Calling it brute force on one account.

  • Business email compromise

    Fraud using a spoofed or compromised business mailbox to request payments or data.

    Remember
    Often has no attachment or link.
    Tested as
    Email attack questions.
    Trap
    Expecting malware to be present.

  • SPF, DKIM and DMARC

    Email authentication: authorized senders, message signing and policy.

    Remember
    DMARC builds on SPF and DKIM alignment.
    Tested as
    Header analysis questions.
    Trap
    Thinking SPF pass proves a legitimate sender.

  • Compromised insider

    An insider account controlled by an external attacker.

    Remember
    Behavior changes while credentials stay valid.
    Tested as
    Insider classification questions.
    Trap
    Labeling the employee as malicious.

  • ARP spoofing

    Sending forged ARP replies to redirect local traffic.

    Remember
    Shows one MAC address mapped to several IPs.
    Tested as
    Network evidence questions.
    Trap
    Confusing it with DNS poisoning.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

IoC vs. IoA

ConceptMeaningKey differenceCommon trap
Indicator of compromise Artifact left after a breach Retrospective and often static Assuming it stops future variants
Indicator of attack Behavior showing an attack in progress Proactive and intent focused Treating it as a hash list

Attack frameworks

ConceptMeaningKey differenceCommon trap
Cyber Kill Chain Seven linear intrusion stages Shows where to break the chain Using it for coverage mapping
MITRE ATT&CK Matrix of tactics and techniques Detailed and non-linear Calling tactics techniques
Diamond Model Adversary, capability, infrastructure, victim Built for pivoting in analysis Treating it as stage-based

Insider types

ConceptMeaningKey differenceCommon trap
Malicious insider Deliberately misuses access Intent to harm Missing pre-resignation signs
Negligent insider Causes harm through carelessness No intent Treating as hostile
Compromised insider Account used by outsider Employee is a victim Blaming the employee

Web attack signatures

ConceptMeaningKey differenceCommon trap
SQL injection Quotes, UNION, OR 1=1, comments Targets the database Calling it XSS
Cross-site scripting Script tags, event handlers Targets other users' browsers Calling it injection into SQL
Directory traversal ../ sequences to system files Targets the file system Confusing with file upload

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Hash blocks the attacker

    What candidates pick
    Choose blocking a malware hash as the most durable defense.
    Why it looks right
    It is precise and easy to deploy.
    Why it's wrong
    Attackers change hashes trivially; behavior and TTP-based detections last longer.

    Clue to watch for The question asks which indicator causes the attacker the most difficulty.

  2. SPF pass means safe

    What candidates pick
    Trust an email because SPF passed.
    Why it looks right
    Authentication passed so the sender seems real.
    Why it's wrong
    SPF only confirms the server may send for that domain, and attackers control their own lookalike domains.

    Clue to watch for A lookalike sender domain appears in the scenario.

  3. Every failed login is brute force

    What candidates pick
    Label many failures across many accounts as brute force.
    Why it looks right
    Failed logins are the classic brute force sign.
    Why it's wrong
    One password tried across many accounts is spraying, which avoids lockout thresholds.

    Clue to watch for Few attempts per account, many accounts.

  4. XSS for any script-looking input

    What candidates pick
    Call any suspicious parameter cross-site scripting.
    Why it looks right
    Both arrive through user input.
    Why it's wrong
    SQL keywords and quotes point to SQL injection; script tags point to XSS.

    Clue to watch for Look for UNION, OR 1=1 or comment markers.

  5. Insider equals malicious

    What candidates pick
    Treat all insider incidents as deliberate.
    Why it looks right
    The word insider suggests betrayal.
    Why it's wrong
    Insiders can be negligent or compromised, and response differs for each.

    Clue to watch for Evidence of phishing or credential theft before the activity.

  6. Kill Chain order

    What candidates pick
    Place exploitation before delivery.
    Why it looks right
    Both happen early in an attack.
    Why it's wrong
    Delivery transmits the weapon to the target and exploitation follows when it runs.

    Clue to watch for The step describes sending the payload.

Answer framework

Apply these steps when a Domain 2 question shows evidence and asks what is happening.

  1. Decide which layer the evidence comes from: network traffic, host artifacts, application requests, email data or user behavior.
  2. Look for the signature detail in the evidence, such as SQL syntax, many ports from one source, a new service or a lookalike domain.
  3. Name the specific technique rather than the broad category, for example password spraying instead of brute force, or typosquatting instead of generic phishing.
  4. Classify any artifact as an IoC or IoA and judge its durability using the Pyramid of Pain, where hashes are easiest to change and TTPs hardest.
  5. If a framework is named, map the activity to the correct Kill Chain stage or ATT&CK tactic before reading the options.

Practice question

Authentication logs show 600 failed logons within ten minutes from one external IP address. The attempts target 300 different user accounts, with two attempts per account, and one account then logs on successfully. Which attack best explains this pattern?

Want more like this? The EC-Council CSA practice test has questions for every domain.

Checklist

0 of 12

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Study this domain by attack type, and for each type write down three things: how it works in one sentence, which data source shows it, and what the evidence looks like. Start with web application attacks, since request strings are easy to practice with; collect sample payloads for SQL injection, XSS, traversal and command injection and quiz yourself on which is which.

Next cover authentication and host attacks using Windows event IDs you will meet again in Domain 3, such as failed and successful logons. Then do email: read a few real message headers, find the SPF, DKIM and DMARC results, and practice spotting lookalike domains. Cover insider types with one example each.

Finish with frameworks. Memorize the seven Kill Chain stages and the Pyramid of Pain levels, browse the ATT&CK Enterprise matrix to learn tactic names, and sketch a Diamond Model for one known incident. About eight questions come from this domain, but the recognition skills here pay off across detection, hunting and response questions.

FAQ

What share of CSA v2 is Understanding Cyber Threats, IoCs, and Attack Methodology?

Understanding Cyber Threats, IoCs, and Attack Methodology is 8% of the blueprint, roughly eight of the 100 questions.

Do I need to perform attacks for this exam?

No. CSA tests whether you can recognize attacks from logs, traffic and artifacts. Exploitation skill is the focus of CEH, not CSA.

What is the difference between an IoC and an IoA?

An IoC is evidence that compromise has already happened, such as a malicious hash. An IoA reflects behavior that shows an attack is under way, regardless of the specific tool.

Which frameworks appear in this domain?

The Cyber Kill Chain, MITRE ATT&CK and the Diamond Model, plus the Pyramid of Pain for judging indicator value.

Why are TTPs at the top of the Pyramid of Pain?

Changing how they operate forces attackers to retool and retrain, which is far more costly than changing an IP address, domain or file hash.

How do I tell password spraying from brute force?

Brute force aims many guesses at one account. Spraying tries a few common passwords across many accounts, so each account sees only a handful of failures.

Are insider threats always deliberate?

No. EC-Council separates malicious, negligent and compromised insiders, and the right response differs for each.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 2 knowledge

You have covered network, host, application, social engineering, email and insider TTPs, indicators and frameworks. Test whether you can name attacks from evidence.

Take the EC-Council CSA practice test Check your EC-Council CSA readiness

Keep going