Topics in this domain
- Event vs Incident vs Breach
- Developing the Incident Response Plan
- Incident Response Team Roles and Authority
- Incident Classification and Severity Levels
- Incident Response Playbooks and Decision Trees
- Escalation and Communication Plans
- Business Impact Analysis
- RTO, RPO, MTD and Recovery Prioritisation
- Business Continuity Planning and Strategies
- Crisis Management and Continuity Governance
- Disaster Recovery Planning
- Recovery Sites: Hot, Warm and Cold
- Backup Strategies and Cloud DR
- Incident Response Training
- Testing Plans: Tabletop, Functional and Full Interruption
- Evaluating Exercises and Improving Readiness
- Security Event Detection and Monitoring Methods
- SIEM, the SOC and Event Correlation
- Threat Intelligence and Indicators of Compromise
- Incident Triage and Initial Investigation
- Evidence Preservation, Forensics and Chain of Custody
- Containment Strategies: Short-Term and Long-Term
- Making Containment Decisions
- Breach Notification and Regulatory Reporting
- External Communications: Customers, Media and Law Enforcement
- Eradication, Recovery and Return to Normal Operations
- Post-Incident Review and Root Cause Analysis
- Lessons Learned and Incident Trend Analysis
Threat Intelligence and Indicators of Compromise
Clues left behind
Attackers leave traces: malicious files, connections to their servers, unusual accounts. Indicators of compromise (IOCs) describe those traces so defenders can find them. Threat intelligence tells you which indicators and techniques are being used right now, and against whom.
IOCs and IOAs
| Indicators of compromise (IOCs) | Indicators of attack (IOAs) | |
|---|---|---|
| What | Evidence a breach may have happened | Behaviour of an attack in progress |
| Examples | File hashes, IP addresses, domains, file names, registry keys | Credential dumping, unusual lateral movement, mass file encryption |
| Strength | Precise, easy to search for | Catches attacks even with new tools |
Indicators feed detection (rules and blocks in the SIEM, EDR, firewalls and email filtering) and investigation (where else does this indicator appear?).
Not all indicators are equal
The pyramid of pain ranks indicators by how hard they are for attackers to change. A file hash changes if one byte changes; a new IP address takes minutes. An attacker’s tactics, techniques and procedures (TTPs) are hardest to change, so detecting techniques gives the most lasting protection.
Using intelligence in an incident
- Find an IOC on the first infected host.
- Search the whole estate (SIEM, EDR) for every occurrence.
- Scope: which systems and accounts are affected?
- Block the domains, IPs and hashes.
- Hunt for the same techniques elsewhere.
Example. An analyst finds a malicious file on one laptop. Searching its hash and the domain it contacted across all endpoints finds seven more infected machines, including a server. Without that search, containment would have stopped at the first laptop.
Sharing intelligence
- Sector ISACs, national CERTs and trusted peer groups share intelligence.
- The Traffic Light Protocol (TLP) marks how widely information may be passed on.
- Get legal review before sharing details of your own incidents.
- Feedback improves the quality of shared intelligence for everyone.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Evidence that a breach may have occurred | An indicator of compromise |
| Hardest indicator for attackers to change | Tactics, techniques and procedures (TTPs) |
| An IOC is found on one system | Search for it across the whole environment |
| Where to share threat intelligence | ISACs, CERTs and trusted groups, under TLP |
| Main limitation of IOC blocking | Attackers change indicators easily |
In short
- Indicators of compromise (IOCs) are evidence that a system may have been breached: file hashes, IP addresses, domains, registry keys, unusual behaviour.
- Indicators of attack (IOAs) focus on attacker behaviour and techniques, and can catch attacks before damage is done.
- The 'pyramid of pain': hashes and IPs are easy for attackers to change; techniques (TTPs) are hard, so detecting TTPs is most valuable.
- Intelligence feeds detection rules, threat hunting, investigation scoping and blocking.
- Sharing through ISACs, CERTs and trusted groups helps everyone; follow traffic light protocol (TLP) and legal advice.
- Intelligence must be relevant and timely; old or irrelevant IOCs create noise.
Exam traps
- Blocking indicators alone won't stop a determined attacker; they change them.
- Raw feeds without context create false positives.
- Sharing incident details externally without legal review can create liability.
- IOCs found during an incident must be searched for across the whole estate, not just the first system.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Not all indicators are equal