Indicators of Compromise 2.4 Flashcards
1
Q
An event that indicates an intrusion is called an […]
Ex:
- Unusual amount of network Traffic
- Change to file hash values
- Irregular international traffic
- Change to DNS data
A
Indicator of Compromise
2
Q
IoC - […]
- Credentials aren’t working
- Exceeded login attempts
- Account possibly administratively disabled
A
Account lockout
3
Q
IoC - […]
- Having two of the same user accounts logged in at different locations
A
Concurrent session usage
4
Q
IoC - […]
- Once an attacker gains access to systems, they might disable:
- Auto Updates
- Links to Security Patches
- Anti Malware sites / removal tools
A
Blocked Content
5
Q
IoC - […]
- Login in Vernon, NJ (Headquarters)
- Three minutes later a login from Russia
- Log analysis
A
Impossible travel / logins from very far away
6
Q
IoC - […]
- Every attackers action has an equal and opposite reaction
- An unusual network spike at 3am (File Transfer from attacker)
- Firewall logs showing and outbound transfer to an unknown IP address
A
Resource Consumption
7
Q
IoC […]
- A server is down
- The network is not functional
- Encrypted data (Ransomware)
- Brute force attack that locks account access
A
Resource Inaccessibility
8
Q
IoC - […]
- Logs are sent in the wrong timeframe
- Essentially logs that are out of place (You didn’t do it so why is it there?)
A
Out of Cycle Logging
9
Q
IoC - […]
- An attacker will try to cover their tracks by removing these
A
Missing Logs
10
Q
IoC - […]
- Private organizational data is exfiltrated and posted
- Either a portion of it or all of it is posted, usually for ransomware
A
Published / Documented
