High consumption of processing, memory and disk access are suspicious behaviours, which should be thoroughly investigated to assess whether an attack is in progress.