Indicators of Compromise (IOC): Understanding, Identifying, and Utilizing Cyber Threat Indicators

Introduction

Organizations face more cyber threats every year. Ransomware, supply chain breaches, the risk of unauthorized access or malicious activity is higher than it has ever been. To detect and respond to these threats, security professionals rely on Indicators of Compromise (IOCs): pieces of forensic data that suggest an information security system may have been breached.

This article walks through what IOCs are, the forms they take, real-world examples, and how they are used in defense. It also covers why IOC databases have to be updated and expanded constantly to keep up with threats that keep changing.

What is an Indicator of Compromise (IOC)?

An Indicator of Compromise (IOC) is a piece of forensic data that suggests an information security system may have been breached. It is a sign that a network or system was reached by unauthorized access or other malicious activity. IOCs surface early, when a team is still working out the nature and extent of a potential breach.

Types of IOCs

IOCs come in various forms, allowing security professionals to identify and respond to a wide range of cyber threats. Some common types of IOCs include:

1. IP Addresses: Unusual outbound communication to known malicious IPs can indicate a compromised system. Monitoring for unusual or unexpected network traffic patterns is an essential aspect of identifying potential breaches.

2. Domain Names: Access to suspicious or malicious domains may suggest unauthorized activities within a network. Regularly updating and monitoring domain name watchlists can help detect potential threats before they escalate into full-blown breaches.

3. URLs: Unusual or malicious URLs can be a sign of phishing or malware distribution attempts. By tracking and analyzing web traffic patterns, security teams can identify and block potentially harmful sites.

4. File Hashes: Unique identifiers for files can help detect the presence of known malware or other malicious programs. Regularly updating hash databases with newly discovered threats ensures that organizations have the most up-to-date information to protect their systems.

5. Email Addresses: Used in phishing attacks, suspicious email addresses can be a valuable IOC for identifying potential breaches. Security teams should monitor incoming and outgoing email traffic for signs of unauthorized activities or communication with known malicious actors.

6. Registry Keys: Unusual changes to registry keys can be a sign of system compromise. Monitoring for unexpected modifications to critical system settings can help detect and respond to potential threats quickly.

Real Examples of IOCs

To better understand the importance and application of IOCs, let’s examine three real-world examples: the WannaCry ransomware, the SolarWinds hack, and the Scatter Spider Group

1. WannaCry Ransomware (2017): This widespread ransomware attack had specific IOCs that could be used to detect and respond to the threat. These IOCs included file hashes of the malware itself, as well as IP addresses of the command and control servers used by the attackers. By monitoring for these IOCs, organizations were able to quickly identify infected systems and take action to prevent further spread of the ransomware.

2. SolarWinds Hack (2020): In this sophisticated supply chain attack, malicious actors gained access to SolarWinds’ Orion software update system, distributing compromised updates to thousands of customers worldwide. The IOCs identified here included specific file hashes and network indicators tied to the malware. Watching for them let organizations spot the breach and move to limit the damage.

3. Scattered Spider (2022): This group has conducted a number of high profile attacks including those against Caesars Entertainment and MGM Resorts International. Our team published IOC’s on the group in early 2023 (here).

How IOCs are Used

IOCs serve multiple purposes in cybersecurity defense, including detection, investigation, and prevention:

1. Detection: Security systems use IOCs to identify potential breaches by monitoring for unusual or unexpected network traffic patterns, file access, or system modifications. By integrating IOC data into security information and event management (SIEM) systems, organizations can quickly detect and respond to threats in real-time.

2. Threat Hunting: Indicators of Compromise (IOCs) are used to proactively identify signs of malicious activities within an organization’s networks. By searching for IOCs linked to known threats or adversaries, hunters can detect potential breaches and neutralize them before they escalate.

3. Breach Investigation: IOCs help in forensic analysis to understand the scope and impact of a breach. Security teams use IOC data to trace the timeline of an attack, identify affected systems or accounts, and determine the extent of the damage. This information is critical for developing effective response strategies and minimizing the overall impact of a breach.

4. Prevention: Known IOCs let organizations block known threats before they land. Security teams configure firewalls to drop traffic from malicious IP addresses, or feed malware file hashes into endpoint protection. Fewer attacks succeed, and resilience improves.

Why We Have to Keep Adding to Them

Cyber threats evolve rapidly, requiring continuous updates and expansion of IOC databases. Several factors contribute to the need for ongoing additions to IOC repositories:

1. Evolving Threats: As cyber threats continue to evolve, new IOCs emerge. Attackers constantly develop new malware variants, exploit previously unknown vulnerabilities (zero-day exploits), and employ advanced tactics, techniques, and procedures (TTPs) to evade detection (for example, POP chains, which still seem to not get the recognition they deserve). Regularly updating IOC databases with these newly discovered threats helps ensure that organizations have the most up-to-date information to protect their systems.

2. Zero-Day Exploits: New vulnerabilities are constantly being discovered in software and hardware components, presenting opportunities for attackers to exploit them before patches or updates become available. Each new zero-day exploit requires the addition of new IOCs to ensure that organizations can detect and respond to these threats effectively. Visit the national vulnerability database to see the continuing increase.

3. Adaptive Adversaries: Attackers often change their tactics, tools, and procedures (TTPs) in response to security measures or detection mechanisms. As a result, previously identified IOCs may become less effective over time. Regularly updating IOC databases ensures that security teams have the latest information on emerging threats and can respond accordingly.

4. Technology Changes: New technologies introduce new kinds of IOCs. For example, the proliferation of Internet of Things (IoT) devices has led to the emergence of unique IoT-specific IOCs. Keeping pace with technological advancements and their associated IOCs is essential for effective cybersecurity defense.

Conclusion

IOCs are how organizations detect, investigate, and respond to threats. But threats keep moving, so the databases behind them have to keep growing. A team that knows the types of IOCs and how they show up in real attacks is a team that catches more.

To discuss IOC’s, how our purple team and threat hunt services can help you put them to good use, or anything else please contact us here.