Indicators of Compromise 2.4

Question 1

Indicators of Compromise (IoC)

Answer 1

• ## An event that indicates an intrusion with high confidence.

Question 2

Common Indicators

Answer 2

• Unusual amount of network activity
• Change to file hash values
• Irregular international traffic.
• Changes to DNS data.
• Uncommon login patterns.
• Spikes of read requests to certain files.

Question 3

Account Lockout

Answer 3

• A temporary blocking of the user’s ability to log into a system.
• Can be considered a Indicator of Compromise.

Question 4

Concurrent Session Usage

Answer 4

• An indicator of compromise.
• Multiple account logins from multiple locations.
• Difficult to track due to user capabilities in having accounts on multiple devices.

Question 5

Purpose of Blocking Content

Answer 5

• While using a compromised account, attacker wants to stay on the system as long as possible.
• Attackers can use malware to Block Content.

Question 6

Type of Block Content

Answer 6

• Auto updates
• Links to security patches
• Third-party anti-malware sites
• Removal tools

Question 7

Impossible Travel

Answer 7

• When the logs show a two logins but at different locations. Especially within a short amount of time.

Question 8

Resource Consumption

Answer 8

• A system does not have all the resources it needs to continue to function.
• Can be an indicator a system is being compromised.

Question 9

Signs of Resource Consumption

Answer 9

• Increased bandwidth usage
• Firewalls logs showing an outgoing transfer.

Question 10

Resource Inaccessibility

Answer 10

• Server is down.
• Network disruption
• Server outage
• Encrypted data
• Brute force attack resulting in a locked account.

Question 11

Out-of-Cycle Logging

Answer 11

• Logs can be an indicator of compromise.
• Information within a log should not be there at that particular time frame.

Question 12

Missing Logs

Answer 12

• Attackers can try to cover up their tracks by removing logs of their activities.
• Logs must be secured and monitored

Question 13

Types of Logs

Answer 13

• Authentication logs
• File access logs
• Firewall logs
• Proxy logs
• Server logs

Question 14

Published/Documented Data

Answer 14

• Clear indication of compromised.
• Attackers will make public the sensitive data of an organization often when performing a ransomware attack.