Reading malware signals before damage spreads

Malware rarely appears as a single obvious warning. It leaves a trail of unusual logins, altered files, suspicious processes, strange DNS requests and unexpected connections to remote infrastructure. These clues are known as indicators of compromise (IOCs), and they help security teams identify malicious activity before it becomes a major breach.

The most useful indicators vary by malware family. A ransomware attack behaves differently from an infostealer, remote access trojan or cryptominer. For Australian organisations, effective detection should also reflect local requirements, including the ACSC Essential Eight, the Notifiable Data Breaches scheme and the operational realities of businesses working across Sydney, Melbourne, Brisbane and regional offices.

Why indicators of compromise matter

An IOC is an observable sign associated with a security incident. It may be a file hash, IP address, domain name, registry change, process, email attachment or unusual pattern of behaviour. A single indicator can be misleading, but several related signals often reveal a credible attack path.

Modern security teams increasingly combine static indicators with behavioural detection. For example, an unfamiliar executable may be harmless, while an unfamiliar executable that creates a scheduled task, disables endpoint protection and contacts a newly registered domain deserves immediate investigation.

Ransomware signals

Ransomware commonly begins with credential theft, phishing, exposed remote services or exploitation of an unpatched system. Early indicators include abnormal PowerShell or Windows Management Instrumentation activity, use of legitimate administration tools at unusual times, and logins from unfamiliar locations.

As the attack progresses, defenders may see mass file renaming, rapid changes to file extensions, deletion of shadow copies, disabled backups and attempts to stop security services. Large-scale access to shared drives is another warning sign, particularly when a user account suddenly touches files across multiple departments.

Australian councils, hospitals and manufacturing sites are attractive targets because disruption can affect public services and physical operations. A well-tuned alert for unusual privileged activity can give an organisation valuable time before systems are encrypted.

Infostealer and credential theft activity

Infostealers target browser passwords, session cookies, cryptocurrency wallets, autofill data and authentication tokens. Common clues include suspicious downloads from file-sharing sites, malicious browser extensions, access to browser credential stores and outbound connections to command-and-control servers shortly after a user opens an attachment.

Security teams should pay close attention to impossible-travel alerts, repeated login failures followed by success, and the use of valid credentials from an unfamiliar device. A stolen session cookie may allow an attacker to bypass a password prompt, so resetting credentials alone may not be enough; active sessions and tokens may also need to be revoked.

For Australian financial services and e-commerce businesses, this activity can quickly become account takeover or payment fraud. Monitoring identity platforms, endpoint telemetry and cloud application logs together provides a clearer picture than reviewing any one source in isolation.

Remote access trojans and banking malware

Remote access trojans allow attackers to control a device, capture keystrokes, collect screenshots or execute commands. Indicators may include unexpected screen-capture processes, microphone access, new startup entries and outbound traffic to hard-coded domains or IP addresses.

Banking malware often redirects users, injects content into browser sessions or monitors visits to financial websites. Security analysts should investigate changes to browser configuration, unfamiliar proxy settings, modified DNS resolution and processes that interact with browsers in unusual ways.

A sudden increase in remote-control tool usage is particularly important in hybrid workplaces. Legitimate software such as remote desktop utilities can be abused, so detection should consider the user, device, time, destination and command history rather than blocking every occurrence.

Worms, botnets and lateral movement

Worms spread automatically by exploiting vulnerabilities, weak passwords or removable media. Key signs include repeated scanning across internal IP ranges, a spike in failed connections, exploitation attempts against exposed services and the same suspicious process appearing on many endpoints.

Botnet infections often generate regular beaconing: small outbound connections to command servers at consistent intervals. Other indicators include unusual DNS queries, contact with newly registered domains, traffic to countries or providers not normally associated with the organisation, and devices communicating directly with peers without a clear business reason.

Network segmentation, rapid patching and strong administrative controls are essential for Australian businesses with legacy systems or distributed branches. An infected workstation in Perth should not be able to reach critical servers in Melbourne simply because both sites share a flat network.

Web shells and cryptomining activity

Web shells provide persistent access to compromised web servers. They may appear as unfamiliar scripts in upload directories, recently modified application files, unexpected administrator accounts or web requests containing encoded commands. Spikes in POST requests and unusual child processes launched by a web service are valuable warning signs.

Cryptominers consume processing power and electricity, often causing sustained CPU usage, overheating, slower applications and unexpected cloud costs. Look for mining pool connections, wallet-related domains, unfamiliar scheduled tasks and containers or virtual machines created outside normal change procedures.

These indicators matter to Australian retailers and healthcare providers that rely on public-facing portals. A compromised booking, patient or shopping platform can expose sensitive information even when the visible symptom is simply poor performance.

Turning alerts into useful evidence

Indicators are most effective when collected centrally and enriched with context. SIEM monitoring can correlate endpoint events, firewall records, identity logs, cloud activity and threat intelligence. This helps distinguish a genuine compromise from routine administration or a noisy scanner.

Incident responders should preserve timestamps, affected hosts, user accounts, process trees, file paths and network destinations. Hashes and IP addresses can become obsolete quickly, while behavioural evidence often remains useful. Threat hunting should therefore search for related activity across the environment instead of stopping at the first infected device.

Detection priorities for Australian organisations

• Map malware indicators to the ACSC Essential Eight and internal risk priorities.
• Centralise endpoint, identity, email, firewall and cloud logs in a SIEM platform.
• Alert on unusual PowerShell, WMI, scheduled tasks and remote administration tools.
• Monitor DNS, proxy and network flows for beaconing and newly registered domains.
• Test backup isolation and restoration procedures before a ransomware incident.
• Revoke compromised sessions and rotate credentials after suspected infostealer activity.
• Maintain an incident response process that supports Notifiable Data Breaches obligations.

Infoziant Security helps organisations investigate suspicious activity through vulnerability assessment and penetration testing, managed security services, threat intelligence and 24/7 SIEM monitoring. Businesses across Australia can request a free VAPT report or begin with a trial-based engagement to identify exposed systems, validate controls and strengthen their response to malware before a warning becomes a breach.