Application indicators are signs of compromise that show up in how software behaves rather than in raw network or host activity. They are often the first clue that a web application, database or business system is under attack, because an attacker who abuses an application may never drop a file or open an unusual port. Recognizing them requires you to know what normal looks like for that specific application: its usual users, its usual request patterns, its usual error rate and its usual response sizes.
Free account
Keep reading for free
Create a free StudyToCert account to read the rest of this lesson: 6 more sections, 6 key terms, a real-world example, an exam tip and self-check questions. Every lesson, lab and practice test is free with an account.