Indicators of Compromise: Defining and Detecting Network Breaches

Defining Indicators of Compromise (IoCs)

• 💡 Indicators of Compromise (IoCs) are defined as digital evidence that a system or network has been breached.
• 🎯 An example sentence illustrates their use: "The indicators of compromise alerted the organization that an adversary was inside the network."

Evolution of IoC Detection

• 🔑 Historically, security practitioners relied on technical lists of known malicious items like IP addresses, URLs, and MD5 hashes.
• ⚠️ These early indicators were passive, lacked context on attacker steps, and were prone to false positives and rapid obsolescence as hackers changed tactics.
• 🚀 The introduction of the MITRE ATT&CK framework expanded IoC concepts to include Tactics, Techniques, and Procedures (TTPs), providing more context and tying intelligence to known adversary behaviors.

Leveraging TTPs for Threat Detection

• 🧠 By observing TTPs, network defenders can forecast the likelihood of compromise by a specific attack sequence.
• 📈 For instance, if a hacker group uses 17 TTPs, observing one common TTP might indicate a low chance of that specific group's involvement, while observing 15 out of 17 TTPs suggests a high probability.
• 🔍 This approach allows for more impactful countermeasures by understanding the adversary's methodology.

Sherlock Holmes and IoCs

• 🎭 A