Indicators of Compromise (IOC) Security - CrowdStrike
文章推薦指數： 80 %
An Indicator of Compromise (IOC) is a piece of digital forensics that suggests that an endpoint or network may have been breached. Cybersecurity101› IndicatorsofCompromise(IOC) IndicatorsofCompromise(IOC)Security May13,2021 IndicatorsofCompromiseExplained AnIndicatorofCompromise(IOC)isapieceofdigitalforensicsthatsuggeststhatanendpointornetworkmayhavebeenbreached.Justaswithphysicalevidence,thesedigitalclueshelpinformationsecurityprofessionalsidentifymaliciousactivityorsecuritythreats,suchasdatabreaches,insiderthreatsormalwareattacks. Investigatorscangatherindicatorsofcompromisemanuallyafternoticingsuspiciousactivityorautomaticallyaspartoftheorganization’scybersecuritymonitoringcapabilities.Thisinformationcanbeusedtohelpmitigateanin-progressattackorremediateanexistingsecurityincident,aswellascreate“smarter”toolsthatcandetectandquarantinesuspiciousfilesinthefuture. Unfortunately,IOCmonitoringisreactiveinnature,whichmeansthatifanorganizationfindsanindicator,itisalmostcertainthattheyhavealreadybeencompromised.Thatsaid,iftheeventisin-progress,thequickdetectionofanIOCcouldhelpcontainattacksearlierintheattacklifecycle,thuslimitingtheirimpacttothebusiness. Ascybercriminalsbecomemoresophisticated,indicatorsofcompromisehavebecomemoredifficulttodetect.ThemostcommonIOCs—suchasanmd5hash,C2domainorhardcodedIPaddress,registrykeyandfilename—areconstantlychanging,whichmakesdetectionmoredifficult. HowtoIdentifyIndicatorsofCompromise Whenanorganizationisanattacktargetorvictim,thecybercriminalwillleavetracesoftheiractivityinthesystemandlogfiles.Thethreathuntingteamwillgatherthisdigitalforensicdatafromthesefilesandsystemstodetermineifasecuritythreatordatabreachhasoccurredorisin-process. IdentifyingIOCsisajobhandledalmostexclusivelybytrainedinfosecprofessionals.Oftentheseindividualsleverageadvancedtechnologytoscanandanalyzetremendousamountsofnetworktraffic,aswellasisolatesuspiciousactivity. Themosteffectivecybersecuritystrategiesblendhumanresourceswithadvancedtechnologicalsolutions,suchasAI,MLandotherformsofintelligentautomationtobetterdetectanomalousactivityandincreaseresponseandremediationtime. WhyYourOrganizationShouldMonitorforIndicatorsofCompromise Theabilitytodetectindicatorsofcompromiseisacrucialelementofeverycomprehensivecybersecuritystrategy.IOCscanhelpimprovedetectionaccuracyandspeed,aswellasremediationtimes.Generallyspeaking,theearlieranorganizationcandetectanattack,thelessimpactitwillhaveonthebusinessandtheeasieritwillbetoresolve. IOCs,especiallythosethatarerecurring,providetheorganizationwithawindowintothetechniquesandmethodologiesoftheirattackers.Assuch,organizationscanincorporatetheseinsightsintotheirsecuritytooling,incidentresponsecapabilitiesandcybersecuritypoliciestopreventfutureevents. ExamplesofIndicatorsofCompromise Whatarethewarningsignsthatthesecurityteamislookingforwheninvestigatingcyberthreatsandattacks?Someindicatorsofcompromiseinclude: Unusualinboundandoutboundnetworktraffic Geographicirregularities,suchastrafficfromcountriesorlocationswheretheorganizationdoesnothaveapresence Unknownapplicationswithinthesystem Unusualactivityfromadministratororprivilegedaccounts,includingrequestsforadditionalpermissions Anuptickinincorrectlog-insoraccessrequeststhatmayindicatebruteforceattacks Anomalousactivity,suchasanincreaseindatabasereadvolume Largenumbersofrequestsforthesamefile Suspiciousregistryorsystemfilechanges UnusualDomainNameServers(DNS)requestsandregistryconfigurations Unauthorizedsettingschanges,includingmobiledeviceprofiles Largeamountsofcompressedfilesordatabundlesinincorrectorunexplainedlocations TheDifferenceBetweenIndicatorofCompromises(IoCs)andIndicatorsofAttack(IoAs) AnIndicatorofAttack(IOA)isrelatedtoanIOCinthatitisadigitalartifactthathelpstheinfosecteamevaluateabreachorsecurityevent.However,unlikeIOCs,IOAsareactiveinnatureandfocusonidentifyingacyberattackthatisinprocess.Theyalsoexploretheidentityandmotivationofthethreatactor,whereasanIOConlyhelpstheorganizationunderstandtheeventsthattookplace. FeaturedArticles WhatisaCyberattack IOAvsIOC
延伸文章資訊
- 1What are Indicators of Compromise? | Digital Guardian
Indicators of compromise act as breadcrumbs that lead infosec and IT pros to detect malicious act...
- 2資安分析師的日常 - iThome
他所在的SOC團隊位於隸屬於公部門組織，使用RiskIQ PassiveTotal調查入侵指標（Indicators of Compromise，IOC），透過PassiveTotal，他們在回...
- 3Indicators of Compromise (IOC) Security - CrowdStrike
An Indicator of Compromise (IOC) is a piece of digital forensics that suggests that an endpoint o...
- 4Indicator of compromise - Wikipedia
Indicator of compromise (IoC) in computer forensics is an artifact observed on a network or in an...
- 5What Are Indicators of Compromise (IoC) | Proofpoint US
During a cybersecurity incident, indicators of compromise (IoC) are clues and evidence of a data ...
