CySA+
  • CySA+ CS0-002 Exam Objectives
  • Threat Intelligence Cycle
  • Intelligence Sources
  • Security Intelligence Sharing
  • Threat Classification and Threat Actors
  • Threat Research and Indicators of Compromise
  • Attack Frameworks and The Cyber Kill Chain
  • Defining Threat Modeling and Threat Hunting
  • Vulnerability Identification and Validation
  • Vulnerability Scan Results and CVSS Scores
  • Nmap and Enumeration
  • Security Controls
  • Defense in Depth Security Baselines
  • Security Trend Analysis
  • Remediation Issues
  • Asset, Change, and Configuration Management
  • Software Development Lifecycle & Development Models
  • Software Assessment and Code Review
  • Mitigating Attack Types Part 1
  • Mitigating Attack Types Part 2
  • Mitigating Attack Types Part 3
  • Password Cracking and Hashing
  • Privilege Escalation & Man-in-the-Middle
  • Network Based IoCs
  • Host Based IoCs
  • Network Architecture and Segmentation
  • Network Traffic, Packet, and Protocol Analysis
  • Pentesting and Active Defense
  • Firewalls
  • URL Analysis & DNS in Malware
  • Network Access Control and Port Security
  • Identity and Access Management (IAM)
  • Web Application Scanners
  • SSL/TLS Digital Certificate Management
  • Mobile Threats
  • Email Threats and Mitigation
  • Data Loss Prevention (DLP)
  • Endpoint Security and Behavior Analysis
  • Hardware Assurance
  • Blackholes and Sinkholes
  • IoT, Embedded Systems & ICS/SCADA Threats
  • Log Analysis & Continuous Security Monitoring
  • SIEM and Event Correlation
  • Malware Analysis
  • Cloud Models and Service Threats
  • Cloud Automation and Other Cloud Threats
  • VDI, Containers, and Microservices
  • CI/CD, IaC, DevOps
  • AI and Machine Learning
  • Digital Forensics
  • Technical Controls for Securing Data
  • Non-Technical Controls for Securing Data
  • Security Policies and Procedures
  • Continuity Planning and Risk Assessment
  • Incident Response Phases and Communication
Powered by GitBook
On this page

Threat Research and Indicators of Compromise

PreviousThreat Classification and Threat ActorsNextAttack Frameworks and The Cyber Kill Chain

Last updated 2 years ago

  • Signature based detection

    • Byte patterns

    • Files, processes, packets

    • Tougher with encrypted data

  • How can malware avoid detection?

    • Has no signature yet

    • Too complex to create a signature

  • Indicators of Compromise

    • Stop looking for signatures, start looking for abnormal behavior.

      • URLs

      • New Files

      • Executions

      • Processes

      • Remote Access Tools

      • File hashes

      • Registry entries

      • Resource usage

      • New apps

      • Protocols

      • New devices

      • Exfiltration

      • New users

  • IoCs: Shift in Perspective

    • Automated HIPS/HIDS

    • Correlation SIEM

    • Deciding if its good or bad

  • Determining IoCs: Reputational Method

    • Historical reputation

      • IP address

      • URL

      • File hash

      • Email body (against spam)

      • Reputation databases provided by major vendors

  • Determining IoCs: Behavioral Method

    • What does it do?

      • Connections

      • Files

      • Settings

  • Attack Tactics, Techniques and Procedures (TTPs)

    • DDoS: connection distribution

    • Malware: resource usage

    • Reconnaissance: Connection pattern

    • APTs:

      • Port hopping: quickly and randomly changing ports

      • Fast flux DNS: quick changes in DNS resolved addresses

      • Data exfiltration: sensitive data or files leaving the network

      • Protocol anomalies: legitimate apps play by the RFC rules (mostly)

  • Threat Modeling: Attacks, signatures, reputation, IoCs and more…

      • SDOs: Stix Domain Objects

    • TAXII – Protocol. Trusted Automated Exchange of Intelligence Information

      • Collections

      • Channels

      • Transmits STIX data overt https.

        • Utility to open IoCs from iocbucket

    • MISP – Malware Information Sharing Project

      • Works with STIX, TAXII

STIX: Structured Threat Information eXpression
https://www.mandiant.com/resources/blog/openioc-basics
https://iocbucket.com/
About STIX | STIX Project Documentation