Analyzing Network IoCs Flashcards
An IP address making regular outbound connections to a known malicious domain.
Command and Control (C2) indicator
Multiple DNS requests for domains with random-looking strings.
DGA (Domain Generation Algorithm) activity
A file hash observed in network traffic that matches a known malware sample.
Malicious file IOC
Repeated TCP SYN packets sent to sequential ports on the same host.
Port scan behavior
An HTTPS connection to a rare or previously unseen IP during off-hours.
Suspicious outbound connection
An internal host trying to connect to external SMTP or FTP servers.
Data exfiltration attempt
The same hash being seen in logs across multiple endpoints.
Lateral propagation
Repeated 401/403 HTTP responses in web traffic logs.
Unauthorized access attempts
Abnormal volume of DNS queries from a single endpoint.
Beaconing indicator
Use of DNS or ICMP traffic for outbound data transmission.
Covert channel
Web traffic from a system to an IP address that doesn’t resolve through DNS.
Hardcoded IP usage
A single internal host communicating with multiple foreign IP addresses.
Botnet behavior
Unusual HTTP user-agent strings in outbound requests.
Malware calling home
Detection of TOR traffic or anonymizing proxy use.
Obfuscation indicator
A sudden spike in outbound connections from one host.
Potential exfiltration or scanning
Network alerts from known blacklisted domains or IPs.
Threat intel match
A series of failed connection attempts followed by one successful connection.
Brute-force indication
A non-DNS service communicating over port 53.
DNS tunneling
Network pattern showing consistent traffic every 60 seconds to the same IP.
Beaconing pattern
Traffic pattern suggesting spread to other systems within the same subnet.
Lateral movement
Network flow logs showing large outbound traffic over non-standard ports.
Anomalous port usage
High volume of HTTP POST requests to a suspicious domain.
Data drop-off point
A new executable downloaded from an external IP via HTTP.
Payload delivery
NetFlow showing unexpected traffic between VLANs.
Internal reconnaissance
Alerts showing unusual connection times from user devices.
Behavior anomaly
Observed traffic using unusual protocols or protocol mismatches.
Protocol abuse
Packet captures showing encrypted traffic where plaintext is expected.
Suspicious encryption use
An increase in ICMP echo requests from a non-administrative system.
Network scanning attempt
SIEM correlation showing similar traffic from multiple infected hosts.
Coordinated attack
Identifying IOCs by comparing live traffic to threat intelligence feeds.
IOC correlation
