5 Indicators of Compromise Free Online FlashCards

What is an indicator of compromise (IOC)?

An indicator of compromise is a technical artifact or observable that suggests an attack may be underway or a system may be compromised; it is evidence to investigate, not proof.

What are host-based indicators?

Host-based indicators come from endpoints, servers, or their logs, such as suspicious files, persistence mechanisms, unusual process trees, or unexpected privilege changes.

What are network-based indicators?

Network-based indicators come from DNS, firewall, proxy, flow, email, or packet records; examples include suspicious destinations, beacon-like connections, and unusual data transfers.

What are behavior-based indicators?

Behavior-based indicators describe suspicious actions or relationships among events, such as discovery commands followed by lateral movement or persistence followed by outbound connections.

Why does a network indicator match need context?

A shared hosting address, cloud service, VPN, content-delivery network, or compromised legitimate website can support both benign and malicious activity, so a network match needs context.

Why compare behavior with a baseline and correlate events?

Behavioral detection often relies on a suitable baseline and event correlation; one unusual action may be routine, while several related actions may warrant investigation.

What should be recorded when documenting an IOC observation?

Record the exact value or behavior, source system, relevant account or asset, event time and time zone, data source, and detection method.

What context should be checked for a published IOC?

Check the intelligence source, observation time, stated confidence, associated activity, and any expiration or review guidance. A reputation label alone does not establish a malicious local match.

How should an IOC match be confirmed?

Verify an exact match on the reported asset and within the relevant time period. For a file, examine its hash, path, signer, creation time, and associated process when available.

How does independent evidence strengthen an IOC assessment?

Correlate independent host, network, identity, and application evidence. Related suspicious activity across the same account or device can strengthen an assessment.

How should investigators test benign explanations for an indicator?

Compare the event with maintenance, approved software, scheduled jobs, security scans, and normal user or system activity. Record uncertainty if key data is unavailable.

Why does an IOC match not prove attribution?

A match does not by itself identify who operated the activity: tools and infrastructure can be shared or copied, and an IOC may link an event to a campaign or tool without proving an actor.