39.5 Indicators of Compromise (IOC)
IOC = clue that intrusion / malware happened or is happening.
Common classes:
- File hashes (MD5/SHA1/SHA256) of known-bad binaries
- C2 domains / IPs / URLs in DNS or proxy logs
- Unusual processes –
powershell -enc ..., Office spawningcmd.exe, random names in%Temp% - Autoruns – Registry Run keys, scheduled tasks, services, startup folders
- DNS spikes – sudden queries to weird DGA-like names; beacon timing
Blue workflow: collect IOC → hunt in SIEM / EDR → isolate hosts → eradicate → lessons. IOCs expire fast (attacker re-packs) – behaviour detections jast durable.
# Linux lab VM – look at listening / established (concepts; your lab only)
ss -tulnp
# Amazon Linux style service check after you install audit tools you choose
sudo service auditd status
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Rotates domains / re-packs binaries (hash churn) | Behaviour rules + threat intel feeds; focus on process ancestry |
| Installs persistence via Run key / task / service | Autoruns baselines; Alert on new tasks under user profiles; Sysmon |
| Beacons every N minutes to C2 | Proxy/DNS anomaly; JA3/TLS patterns where tooling allows; blocklist |
Ravindra Bagale's Tip
Students ek hash block karun "secure" mhantat. Hash = yesterday cha news. Process tree + network egress + persistence hunt = aajcha Blue. CEH exam modules madhe IOC terminology yetay – definition clear theva.
Practice task
Amir (fictional junior SOC, Pune) la 6 IOC milale: 2 hashes, 1 domain, 1 IP, 1 weird task name, 1 parent-child (WINWORD → powershell). Priority order liha: isolate host aadhi ki hash firewall block? 8-line runbook.
Real incident: NotPetya (2017)
NotPetya (reported by national CERTs and major outlets) looked like ransomware to many victims but behaved as a destructive wiper in important analyses – data recovery by paying was not a reliable path. Spread used credential theft and SMB lateral patterns after initial supply-chain style foothold (MeDoc update ecosystem – public reporting). Defence: segmentation, backup isolation, patch, identity hygiene. Source: CERT and major technical postmortems (verify).