Indicators of compromise - Learn Tech From Zero

3.3 Describe the role of attribution in an investigation

📘Cisco Certified CyberOps Associate (200-201 CBROPS)

1. What are Indicators of Compromise?

Definition: Indicators of Compromise, or IOCs, are pieces of evidence that show a computer system or network may have been attacked or breached.
Think of IOCs as digital “red flags” that something bad has happened on your system.
They help cybersecurity analysts detect, investigate, and respond to security incidents.

2. Why IOCs are important in investigations

IOCs help identify attacks early, which reduces damage.
They allow investigators to trace the origin of the attack (attribution).
They are used in forensics to figure out which systems were affected and how.
They provide information for preventing future attacks.

3. Common Types of IOCs in an IT environment

a. File-Based Indicators

Malicious files or malware signatures:
- Example: A suspicious executable file in the C:\Windows\Temp folder.
- Example: A file with a known hash value associated with malware (MD5, SHA256 hash).
Why it matters: If a file matches a known malware signature, it indicates compromise.

b. Log-Based Indicators

Unusual log entries in system or application logs:
- Failed login attempts from unknown IP addresses.
- Logs showing privilege escalation (a normal user gaining admin access).
Why it matters: Abnormal logs show that attackers might be trying to gain access or move inside the network.

c. Network-Based Indicators

Suspicious network activity:
- Traffic to unusual IP addresses or countries.
- Connections to command-and-control (C2) servers.
- Large amounts of outbound traffic from one system.
Why it matters: Attackers often communicate with external servers to control malware or steal data.

d. Registry-Based Indicators (Windows systems)

Changes in the Windows registry that shouldn’t happen:
- New startup programs in HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run pointing to malware.
- Modified system policies to disable security features.
Why it matters: Persistent malware often modifies the registry to survive reboots.

e. Process-Based Indicators

Unusual running processes:
- Unknown processes consuming high CPU or memory.
- Processes with random names (e.g., xy12abcd.exe) in system folders.
Why it matters: Malware often runs as a hidden or disguised process.

f. Email-Based Indicators

Suspicious emails that indicate phishing attacks:
- Emails from unknown senders with attachments or links.
- Emails with strange subjects or domains that look like your company’s domain.
Why it matters: Phishing emails are often the first step in a compromise.

g. Behavioral Indicators

Changes in system behavior, like:
- System suddenly slowing down.
- Unexpected network connections.
- Applications crashing frequently.
Why it matters: Even without logs, abnormal behavior can signal compromise.

4. How IOCs are used in an investigation

Detection – Security tools (like SIEMs or antivirus) alert on IOCs.
Containment – Isolate affected systems based on detected IOCs.
Analysis – Examine the IOCs to understand what happened and who might be responsible.
Remediation – Remove malware, fix vulnerabilities, and restore systems.
Prevention – Update security policies and watch for the same IOCs in the future.

5. Examples of IOCs in IT systems

File hash of a known ransomware (SHA256: 3a2f…) detected on a server.
Thousands of failed login attempts from an unknown IP range.
Outbound traffic to malicious.example.com from an internal workstation.
Windows registry key modified to auto-run a suspicious program.
New processes like svch0st.exe in C:\Windows\System32 (note the misspelling — attackers often do this to hide).

6. Tools that help detect IOCs

SIEM tools – Collect and analyze logs for suspicious activity.
Endpoint Detection and Response (EDR) – Monitors processes, files, and registry changes.
Threat Intelligence Platforms – Provide known IOCs to compare with your environment.
Network monitoring tools – Detect unusual network traffic.

7. Key Exam Tips

Remember: IOCs = Evidence of compromise.
Know the different types of IOCs: files, logs, network traffic, registry, processes, emails, behavior.
IOCs are used to detect, investigate, and respond to cyberattacks.
You may see scenarios asking:
- “Which IOC would indicate malware presence?” → Think file hashes, unknown processes, registry changes.
- “Which IOC shows abnormal network activity?” → Look for C2 traffic, unusual IP connections.

✅ Summary:
Indicators of Compromise (IOCs) are the digital clues that something malicious is happening in an IT environment. They can come from files, logs, networks, registries, processes, emails, or abnormal behaviors. Detecting IOCs early allows cybersecurity analysts to contain attacks, analyze incidents, and prevent future breaches. For the exam, focus on types of IOCs and how they are used in investigations.