Difference between revisions of "Indicators of compromise (IOC)"
Jump to navigation
Jump to search
Tags: Mobile web edit, Mobile edit |
Tags: Mobile web edit, Mobile edit |
||
| Line 5: | Line 5: | ||
A common set: | A common set: | ||
| − | *Unusual outbound network traffic | + | * Unusual outbound network traffic |
| − | *Anomalies in privileged user account activity | + | * Anomalies in privileged user account activity |
| − | *Geographical irregularities in network traffic | + | * Geographical irregularities in network traffic |
| − | *Account login red flags | + | * Account login red flags |
| − | *Increases in database read volumes | + | * Increases in database read volumes |
| − | *HTML response sizes | + | * HTML response sizes |
| − | *Large numbers of requests for the same file | + | * Large numbers of requests for the same file |
| − | *Mismatched port-application traffic, including encrypted traffic on plain ports | + | * Mismatched port-application traffic, including encrypted traffic on plain ports |
| − | *Suspicious registry or system file changes | + | * Suspicious registry or system file changes |
| − | *Unusual DNS | + | * Unusual DNS requests |
| − | *Mobile device profile changes | + | * Unexpected patching of systems |
| − | *Bundles of data in the wrong place | + | * Mobile device profile changes |
| − | *Web traffic with nonhuman behavior | + | * Bundles of data in the wrong place |
| − | *Signs of DDoS activity, even if temporary | + | * Web traffic with nonhuman behavior |
| + | * Signs of DDoS activity, even if temporary | ||
== Related terms == | == Related terms == | ||
| Line 24: | Line 25: | ||
==See also== | ==See also== | ||
| − | *{{Security}} | + | * {{Security}} |
| + | * {{CEH}} | ||
Revision as of 06:23, 7 September 2021
When a threat actor makes changes to a system, either by direct action, malware, or other exploits, forensic artifacts are left behind in the system. IOCs act as bread crumbs for investigators, providing little clues that can help identify the presence of an attack on a system.
There are toolsets to aid the investigator in this task. Tools such as YARA.
A common set:
- Unusual outbound network traffic
- Anomalies in privileged user account activity
- Geographical irregularities in network traffic
- Account login red flags
- Increases in database read volumes
- HTML response sizes
- Large numbers of requests for the same file
- Mismatched port-application traffic, including encrypted traffic on plain ports
- Suspicious registry or system file changes
- Unusual DNS requests
- Unexpected patching of systems
- Mobile device profile changes
- Bundles of data in the wrong place
- Web traffic with nonhuman behavior
- Signs of DDoS activity, even if temporary
Related terms
See also
- Security: Security portfolio, Security standards, Hardening, CVE, CWE, Wireless Network Hacking, vulnerability scanner, Security risk assessment, SCA, Application Security Testing, OWASP, Data leak, NIST, SANS, MITRE, Security policy, Access Control attacks, password policy, password cracking, Password manager, MFA, OTP, UTF, Firewall, DoS, Software bugs, MITM, Certified Ethical Hacker (CEH) Contents, Security+ Malware, FIPS, DLP, Network Access Control (NAC), VAPT, SIEM, EDR, SOC, pentest, PTaaS, Clickjacking, MobSF, Janus vulnerability, Back Orifice, Backdoor, CSO, CSPM, PoLP, forensic, encryption, Keylogger, Pwn2Own, CISO, Prototype pollution
- Certifications: Certified Ethical Hacker (CEH), Certified Ethical Hacker (CEH) Exam
Advertising:
