Indicators of Compromise Flashcards
Indicators or signs that unauthorized activity has compromised an information system
Indicators of Compromise
IOCs act as breadcrumbs for
incident response investigators
IOCs symptoms can sometimes be exhibited due to
technical issues
Unusual outbound
network traffic
Anomalies in
privileged user account activity
Geographical irregularities in
network traffic
account login
Red flags
Database read volume
Increas
Large number of requests
for same files
Mismatched port-application traffic
encrypted traffic over plain ports
Suspicious registry or
system file changes
Unusual DNS
Requests
Unexpected system
patching
Mobile device
profile changes
Bundles of data in
wrong places
Web traffic with non-human
behavior
Signs of DDoS attempts
even if temporary
Framework created by Mandiant and is opensource
OpenIOC
Structured Threat Information Expression
STIX
Trusted Automated Exchange of Indicatior Information
TAXII
Cyber Observable Expression
CybOX
Designed by MITRE specifically to facilitate automated information sharing between organizations
STIX/TAXII/CybOx
Piece of software designed to do something nefarious
Malware
Malware that changes its code after each use, making each replication different for detection purposes.
Polymorphic Malware
Piece of malicious code that replicates by attaching itself to another piece of executable code
Virus
Most viruses found are dissected by reverse engineering to understand what they’re doing, where they come from and these viruses aim to stop these efforts
Armored Viruses
The early beginning of ransomware, that aims to create a DoS by encrypting certain files
Crypto-malware
Encrypts files though automated means that the attacker uses to demand ransom in exchange for encryption keys
Ransomware
Malware that once on a network can traverse and spread independently
Worm
Depends on another piece of code to execute
Virus
Can replicate and execute on its own
Worm
Program that charades with one characterisitc or functionality but has another nefarious purpose
Trojan
Form of malware designed specifically to modify operations of the OS to facilitate non-standard functionality
Rootkit
SW that logs every keystroke of an end user
Keylogger
Sw supported by advertising.
Adware
Malware that spies on user activity and reports stolen information
Spyware
Piece of sw that performs tasks under the control of another program
Bots
Toolkit designed to gain unauthorized access to the targeted system
Remote-Access Trojan (RAT)
Deliberately installed piece of software that sits dormant until some event that triggers malicious payload
Logic Bomb
After gaining unauthorized access to a system, some attackers will install what’s knonw as a backdoor.
Backdoor
Means to esure they gain entry if initial access was discovered.
