Indicators of compromise (IOC)

From wikieduonline
Revision as of 07:40, 20 April 2020 by Darkuser (talk | contribs)
Jump to navigation Jump to search

When a threat actor makes changes to a system, either by direct action, malware, or other exploits, forensic artifacts are left behind in the system. IOCs act as bread crumbs for investigators, providing little clues that can help identify the presence of an attack on a system.

There are toolsets to aid the investigator in this task. Tools such as YARA.

A common set:

  • Unusual outbound network traffic
  • Anomalies in privileged user account activity
  • Geographical irregularities in network traffic
  • Account login red flags
  • Increases in database read volumes
  • HTML response sizes
  • Large numbers of requests for the same file
  • Mismatched port-application traffic, including encrypted traffic on plain ports
  • Suspicious registry or system file changes
  • Unusual DNS requests•  Unexpected patching of systems
  • Mobile device profile changes
  • Bundles of data in the wrong place
  • Web traffic with nonhuman behavior
  • Signs of DDoS activity, even if temporary

See also

Advertising: