Section 19.186 Indicators of compromise (IoC) Flashcards
Objective 2.4 Given a scenario, you must be able to analyse indicators of malicious activity
Indicators of Compromise (IoC)
Pieces of forensic data that identify potentially malicious activity on a network or system
■ Serves as digital evidence that a security breach has occurred
IoC includes…
Account Lockouts
Occurs when an account is locked due to multiple failed login attempts
■ Indicates a potential brute force attack to gain access
■ Balancing security with usability is crucial when implementing account
lockout
IoC includes…
Concurrent Session Usage
Refers to multiple active sessions from a single user account
■ Indicates a possible account compromise when the legitimate user is also logged in
IoC includes…
Blocked Content
Involves attempts to access or download content blocked by security protocols
■ Suggests a user trying to access malicious content or an attacker attempting to steal data
IoC includes…
Impossible Travel
Detects logins from geographically distant locations within an unreasonably short timeframe
■ Indicates a likely account compromise as physical travel between these
locations is impossible
IoC includes…
Resource Consumption
Unusual spikes in resource utilisation
● CPU
● Memory
● Network bandwidth
■ May indicate malware infections or Distributed Denial of Service (DDoS) attacks
IoC includes…
Resource Inaccessibility
Inability to access resources like files, databases, or network services
■ Suggests a ransomware attack, where files are encrypted, and a ransom is
demanded
IoC includes…
Out-of-Cycle Logging
Log entries occurring at unusual times
■ Indicates an attacker trying to hide their activities during off-peak hours
IoC includes…
Missing Logs
Sign that logs have been deleted to hide attacker activities
■ May result in gaps in the log data, making it harder to trace the attacker’s
actions
IoC includes…
Published Articles or Documents
Attackers publicly disclose their actions, boasting about their skills or causing reputational damage
■ Can occur on social media, hacker forums, newspaper articles, or the victim’s own website
