A security team opens an incident with no malware alert at all. It starts with an account that locked itself out twenty times overnight, a single sign-in from a country no employee is in, and a server whose security log is suspiciously short. There is no file to hash and no process to inspect yet. The evidence is in patterns of behavior: who logged in, from where, how often, and what got erased. Reading those patterns is often how a breach is first noticed, long before anyone finds the binary.
These are behavioral indicators of compromise. On the CompTIA Security+ SY0-801 exam this sits under objective 2.5, which asks you to analyze indicators of malicious activity given a scenario, and behavioral indicators lend themselves to log-reading questions. This lesson covers account lockouts, impossible travel, concurrent sessions, timestamp anomalies and timestomping, log manipulation including Windows event 1102, and excessive resource consumption from cryptominers or exfiltration. It ends with a patient-zero exercise: given several hosts' logs, decide which was infected first. The atomic indicators, hashes, addresses, processes and artifacts, were the previous lesson.
Behavioral indicators show up in logs as patterns, not as single bad files
A behavioral indicator is a pattern of activity that doesn't fit what normal use looks like. It is defined by a baseline: you have to know what usual looks like before unusual means anything. One failed login is nothing; two hundred against one account in a minute is an attack. One sign-in from a laptop is nothing; the same account signed in from two continents at once is a compromise. The indicator is the deviation.
That makes behavioral indicators harder for an attacker to avoid than atomic ones. An adversary can recompile to change a hash or rotate a domain, but to steal data they still have to authenticate, move, and consume resources, and those actions leave patterns. It also makes them noisier and more prone to false positives, so analysis leans on correlation and on knowing the environment. The sources are identity and authentication logs, VPN and sign-in records, endpoint and performance telemetry, and the audit logs themselves. Work through the main behavioral indicators, then combine them in a timeline.
Account lockouts can mean an attack on the password or on the user's access
An account lockout happens when too many failed authentication attempts trip the lockout threshold and the system disables the account for a period. On Windows, a lockout is recorded as event ID 4740, and the failed logons that lead to it as event ID 4625. Lockouts can point to two different problems, and a scenario may expect you to tell which.
A burst of failed logons across many accounts usually means an online password attack. Brute forcing tries many passwords against one account, and the lockout is what stops it. Password spraying tries one common password against many accounts to stay under each account's threshold, so it shows up as a wide spread of 4625 failures, with lockouts only where the attacker misjudged the threshold. A wave of 4625 failures, with or without 4740 lockouts, especially outside business hours or from one source, points to a credential attack (which is the subject of its own section). But a lockout can also be the goal rather than a side effect: an attacker who deliberately trips the lockout on real users' accounts is attacking availability, locking legitimate people out, not trying to get in. And a single user locked out repeatedly from their own devices usually points to stale cached credentials rather than an attacker.
Read the scenario for the shape. Many accounts failing from one source is guessing. One account hammered until it locks, with no interest in success, is a denial attack on that user. The same user locking out across their own sessions after a password change often means an old password cached somewhere. The response differs accordingly: investigate the source and tighten authentication for guessing, and for a single mysterious repeat offender, look at the device.