Indicators of Compromise (IOC) Security - CrowdStrike
文章推薦指數： 80 %
An Indicator of Compromise (IOC) is a piece of digital forensics that suggests that an endpoint or network may have been breached. Cybersecurity101› IndicatorsofCompromise(IOC) IndicatorsofCompromise(IOC)Security May13,2021 IndicatorsofCompromiseExplained AnIndicatorofCompromise(IOC)isapieceofdigitalforensicsthatsuggeststhatanendpointornetworkmayhavebeenbreached.Justaswithphysicalevidence,thesedigitalclueshelpinformationsecurityprofessionalsidentifymaliciousactivityorsecuritythreats,suchasdatabreaches,insiderthreatsormalwareattacks. Investigatorscangatherindicatorsofcompromisemanuallyafternoticingsuspiciousactivityorautomaticallyaspartoftheorganization’scybersecuritymonitoringcapabilities.Thisinformationcanbeusedtohelpmitigateanin-progressattackorremediateanexistingsecurityincident,aswellascreate“smarter”toolsthatcandetectandquarantinesuspiciousfilesinthefuture. Unfortunately,IOCmonitoringisreactiveinnature,whichmeansthatifanorganizationfindsanindicator,itisalmostcertainthattheyhavealreadybeencompromised.Thatsaid,iftheeventisin-progress,thequickdetectionofanIOCcouldhelpcontainattacksearlierintheattacklifecycle,thuslimitingtheirimpacttothebusiness. Ascybercriminalsbecomemoresophisticated,indicatorsofcompromisehavebecomemoredifficulttodetect.ThemostcommonIOCs—suchasanmd5hash,C2domainorhardcodedIPaddress,registrykeyandfilename—areconstantlychanging,whichmakesdetectionmoredifficult. HowtoIdentifyIndicatorsofCompromise Whenanorganizationisanattacktargetorvictim,thecybercriminalwillleavetracesoftheiractivityinthesystemandlogfiles.Thethreathuntingteamwillgatherthisdigitalforensicdatafromthesefilesandsystemstodetermineifasecuritythreatordatabreachhasoccurredorisin-process. IdentifyingIOCsisajobhandledalmostexclusivelybytrainedinfosecprofessionals.Oftentheseindividualsleverageadvancedtechnologytoscanandanalyzetremendousamountsofnetworktraffic,aswellasisolatesuspiciousactivity. Themosteffectivecybersecuritystrategiesblendhumanresourceswithadvancedtechnologicalsolutions,suchasAI,MLandotherformsofintelligentautomationtobetterdetectanomalousactivityandincreaseresponseandremediationtime. WhyYourOrganizationShouldMonitorforIndicatorsofCompromise Theabilitytodetectindicatorsofcompromiseisacrucialelementofeverycomprehensivecybersecuritystrategy.IOCscanhelpimprovedetectionaccuracyandspeed,aswellasremediationtimes.Generallyspeaking,theearlieranorganizationcandetectanattack,thelessimpactitwillhaveonthebusinessandtheeasieritwillbetoresolve. IOCs,especiallythosethatarerecurring,providetheorganizationwithawindowintothetechniquesandmethodologiesoftheirattackers.Assuch,organizationscanincorporatetheseinsightsintotheirsecuritytooling,incidentresponsecapabilitiesandcybersecuritypoliciestopreventfutureevents. ExamplesofIndicatorsofCompromise Whatarethewarningsignsthatthesecurityteamislookingforwheninvestigatingcyberthreatsandattacks?Someindicatorsofcompromiseinclude: Unusualinboundandoutboundnetworktraffic Geographicirregularities,suchastrafficfromcountriesorlocationswheretheorganizationdoesnothaveapresence Unknownapplicationswithinthesystem Unusualactivityfromadministratororprivilegedaccounts,includingrequestsforadditionalpermissions Anuptickinincorrectlog-insoraccessrequeststhatmayindicatebruteforceattacks Anomalousactivity,suchasanincreaseindatabasereadvolume Largenumbersofrequestsforthesamefile Suspiciousregistryorsystemfilechanges UnusualDomainNameServers(DNS)requestsandregistryconfigurations Unauthorizedsettingschanges,includingmobiledeviceprofiles Largeamountsofcompressedfilesordatabundlesinincorrectorunexplainedlocations TheDifferenceBetweenIndicatorofCompromises(IoCs)andIndicatorsofAttack(IoAs) AnIndicatorofAttack(IOA)isrelatedtoanIOCinthatitisadigitalartifactthathelpstheinfosecteamevaluateabreachorsecurityevent.However,unlikeIOCs,IOAsareactiveinnatureandfocusonidentifyingacyberattackthatisinprocess.Theyalsoexploretheidentityandmotivationofthethreatactor,whereasanIOConlyhelpstheorganizationunderstandtheeventsthattookplace. FeaturedArticles WhatisaCyberattack IOAvsIOC
延伸文章資訊
- 1Indicators of Compromise (IOC) Security - CrowdStrike
An Indicator of Compromise (IOC) is a piece of digital forensics that suggests that an endpoint o...
- 2Indicators of Attack Vs. Indicators of Compromise - CrowdStrike
An IOC is often described in the forensics world as evidence on a computer that indicates that th...
- 3Indicators of Compromise (IOCs) - Fortinet
- 4What Are Indicators of Compromise (IoC) | Proofpoint US
During a cybersecurity incident, indicators of compromise (IoC) are clues and evidence of a data ...
- 5What are Indicators of Compromise? | Digital Guardian
Indicators of compromise act as breadcrumbs that lead infosec and IT pros to detect malicious act...
