Indicators of attack

3.3 Describe the role of attribution in an investigation

📘Cisco Certified CyberOps Associate (200-201 CBROPS)

---

What Are Indicators of Attack?

Indicators of Attack, often called IoAs, are clues that a system or network is currently being attacked or that an attack is actively happening.

Unlike Indicators of Compromise (IoCs), which tell you what has already been affected (like a file being deleted or malware already installed), IoAs focus on detecting the attack in progress. Think of them as early warning signs.

In simpler terms:

• IoC = “The attacker already succeeded.”
• IoA = “The attacker is trying to get in right now.”

---

Why IoAs Are Important

1. Early detection: Catch attacks before they cause damage.
2. Improved response: Security teams can stop threats before sensitive data is stolen.
3. Better investigation: Helps understand attacker methods and predict next steps.
4. Attribution: Helps identify who or what is behind the attack by tracking patterns.

---

Examples of Indicators of Attack in IT Environments

Here are some common IoAs in cybersecurity, focusing on realistic IT examples:

1. Unusual Login Behavior
   • Multiple failed logins from the same user in a short time.
   • Logins from unexpected locations or IP addresses.
   • Logins at odd hours when the user usually isn’t active.
2. Suspicious Process Activity
   • A process running in memory that shouldn’t normally run.
   • Programs attempting to escalate privileges (e.g., gaining admin/root access).
3. Unexpected Network Traffic
   • Outbound traffic to unknown IPs or countries.
   • High volumes of traffic from a single host that normally doesn’t generate much traffic.
   • Use of uncommon ports/protocols that could indicate tunneling or command-and-control (C2) communication.
4. Changes to System Configuration
   • Unexpected changes in firewall rules or security settings.
   • New accounts created without approval.
   • Scheduled tasks added that trigger malware or scripts.
5. Malicious File Behavior
   • Files trying to encrypt multiple files quickly (ransomware behavior).
   • Unauthorized execution of scripts or macros.
   • Attempts to disable antivirus or endpoint protection software.
6. Use of Privileged Commands
   • Executing commands like netstat, whoami, or ps in unusual ways to gather system information.
   • Commands that extract passwords or sensitive information.

---

How IoAs Are Used in an Investigation

1. Detection Tools
   • Security Information and Event Management (SIEM) systems can detect IoAs by analyzing logs and patterns.
   • Endpoint Detection and Response (EDR) tools monitor systems for suspicious activity.
2. Analysis
   • Analysts look for patterns of behavior, not just isolated events.
   • Example: A failed login followed by privilege escalation could indicate a brute-force attack in progress.
3. Response
   • If an IoA is confirmed, security teams can:
     • Block the attacker’s IP address.
     • Disable compromised accounts.
     • Isolate affected systems from the network.
4. Attribution Support
   • By linking specific IoAs to attack methods, analysts can often identify the type of attacker (hacker group, malware type, insider threat, etc.).

---

IoA vs. IoC – Quick Comparison Table

Feature	Indicator of Attack (IoA)	Indicator of Compromise (IoC)
Timing	During the attack	After the attack
Purpose	Detect attack in progress	Confirm system was compromised
Example	Unusual login attempts	Malware installed, file altered
Action	Stop attack early	Investigate and remediate damage

---

Key Points to Remember for the Exam

1. IoAs focus on active attacks, not past compromises.
2. They help detect, respond, and attribute attacks faster.
3. They are behavior-based, meaning they look for suspicious actions, not just known malware signatures.
4. IoAs are critical for cyber investigations, enabling proactive defense.

---

💡 Tip for remembering:

• IoC = “It’s too late, the compromise happened.”
• IoA = “Stop them before they succeed!”