6.1.6. Observed Activity

6.1.6.1. Observed Host Activity

	6.1.6.1.1. System Cannot Boot
	6.1.6.1.10. Files are deleted, corrupted, or inaccessible
	6.1.6.1.11. Unusual items appear on the screen, such as odd
	6.1.6.1.12. Unexpected dialog boxes appear, requesting permission to do something
	6.1.6.1.2. Error message displayed during system boot
	6.1.6.1.3.System instability and crashes occur
	6.1.6.1.4. Programs start slowly, run slowly, or do not run
	6.1.6.1.5. Unknown processes are run at system startup
	6.1.6.1.6. Unusual and unexpected ports open
	6.1.6.1.7. Sudden increase occurs in the number of e-mails being
	6.1.6.1.8. Changes are made in templates for word processing documents,
	6.1.6.1.9. Web browser configuration is changed, such as different home

6.1.6.2. Observed Network Activity