Cyber Security Awareness: What Are Indicators of Compromise (IoC)

Cybersecurity incidents are becoming increasingly common. Organizations must prepare themselves to respond quickly and effectively in order to protect their data. One of the most important steps in responding to a breach is understanding what happened by collecting evidence of the attack known as indicators of compromise (IoC).

IoCs provide valuable clues as to how an attack happened, whether it was caused by an insider or outsider threat, and how far it may have spread.

In this article, we’ll explain what IoC is and how to identify it.

What are Indicators of Compromise (IoC)?

Indicators of Compromise (IoCs) are signs or evidence that a system or network has been breached or compromised by unauthorized individuals or malicious actors. These indicators help identify potential security incidents and allow organizations to take appropriate actions to mitigate the impact.

It’s important to note that none of the indicators alone can definitively confirm a compromise. However, when multiple indicators are observed, it is crucial to investigate further and take appropriate remedial actions, such as isolating affected systems, conducting forensic analysis, patching vulnerabilities, and implementing additional security measures.

Unusual network traffic

An increase in suspicious network traffic, such as unexpected data transfers, unusual communication patterns, or connections to suspicious IP addresses, can indicate a compromise.

Unauthorized access

Evidence of unauthorized access, such as login attempts using invalid credentials, multiple failed login attempts, or login attempts from unfamiliar locations or devices, may suggest a compromise.

Unusual system behavior

Unexplained system crashes, slowdowns, or freezes can be signs of compromise. Unexpected pop-up messages, changes in system configurations, or the presence of unknown software or processes can also indicate a breach.

Data exfiltration

Unusual or unauthorized transfer of sensitive data from the network or system, especially to external destinations or through unfamiliar channels, may indicate a compromise.

Suspicious files or software

The presence of suspicious files, malware, or backdoors on systems can be indications of compromise. Unusual file modifications, unexpected file encryption, or the sudden appearance of new, unknown files or processes can raise suspicion.

Anomalies in logs and audit trails

Unusual entries or anomalies in system logs, event logs, or audit trails, such as repeated failed authentication attempts, unauthorized access attempts, or suspicious activities, can indicate a compromise.

Security software alerts

If security software or intrusion detection systems generate alerts indicating potential threats or suspicious activities, it may suggest a compromise.

What is IoC in cyber security?

In cybersecurity, IoCs help security teams identify potential security incidents and take appropriate actions to mitigate the impact. IoCs can include unusual network traffic patterns, the presence of malicious software or files, unauthorized access attempts, and other abnormal activities that indicate a security breach.

IoCs serve as digital breadcrumbs that can provide valuable information about the nature of an attack, the tools used, and the identity of the attackers. By monitoring and analyzing IoCs, security teams can better detect, investigate, and respond to cybersecurity incidents.

Examples of IoC

While cannot provide real-time examples, here is an example of an Indication of Compromise (IoC).

Please note that this is just one example of an IoC, and there can be various other indicators depending on the specific circumstances and attack vectors involved. It’s important to stay updated with the latest cybersecurity practices and consult with security professionals to identify and respond to IoCs effectively.

Unusual Network Traffic

An organization notices a significant increase in outbound network traffic from a specific server within its network during off-peak hours. Upon further investigation, they discover that the traffic is being sent to an unknown IP address located in a foreign country. This unusual network traffic could be an indication that the server is compromised and is exfiltrating sensitive data to an unauthorized location.

Anomalies in Privileged User Account Activity

If privileged user accounts, such as administrators, are performing actions at unusual times or accessing resources they don’t usually interact with, this could be a sign of a compromised account.

Suspicious Files, Applications, and Processes

The presence of unexpected or malicious files, applications, and processes on a system can suggest that it has been compromised, for instance.

How to identify IoCs

Remember that the effectiveness of IoC identification relies on continuous monitoring, staying updated with the latest threat intelligence, and leveraging a combination of technical tools and human expertise. It’s also important to prioritize IoCs based on their relevance and potential impact to focus your resources on critical threats.

To identify Indicators of Compromise (IoCs) in cybersecurity, you can follow several approaches and use various techniques. Here are some common methods:

Network Monitoring

Implement network monitoring tools to analyze network traffic and look for anomalies or suspicious patterns. Monitor network logs, including firewall logs, intrusion detection system (IDS) logs, and network flow data. Look for unusual connections, suspicious IP addresses, or unexpected data transfers.

Endpoint Detection and Response (EDR)

Use endpoint security solutions that provide EDR capabilities. These tools monitor endpoints such as workstations and servers for abnormal behavior, known malware signatures, or indicators associated with malicious activity. They can help identify IoCs on individual systems.

Log Analysis

Analyze system logs, event logs, and audit trails from various sources like servers, applications, and security devices. Look for any unusual or suspicious activities, such as failed login attempts, unauthorized access, or anomalous user behaviors.

Threat Intelligence Feeds

Subscribe to threat intelligence feeds provided by reputable cybersecurity vendors, industry organizations, or government agencies. These feeds contain IoCs derived from research, analysis, and real-world incidents. Monitoring these feeds can help identify known IoCs associated with specific threats or attack campaigns.

Malware Analysis

Conduct malware analysis to identify IoCs associated with malicious software. Use sandboxing environments or specialized tools to execute and analyze suspicious files. Look for indicators such as file hashes, domain names, IP addresses, or command-and-control (C2) communication patterns.

Incident Response

During incident response activities, collect and analyze evidence related to the security incident. This can include examining compromised systems, reviewing system memory dumps, analyzing network traffic captures, or conducting forensic investigations. These activities can help identify IoCs left behind by attackers.

Threat Hunting

Proactively search for IoCs by actively investigating systems, networks, or applications for signs of compromise. This involves using a combination of manual analysis, automated tools, and security expertise to dig deeper into potential threats and identify IoCs that may have been missed by traditional security controls.

Indicators of Compromise vs. Indicators of Attack

Indicators of Compromise (IoCs) and Indicators of Attack (IoAs) are both crucial concepts in cybersecurity. But they differ in their focus and scope.

While IoCs focus on the artifacts or evidence left after a compromise, IoAs focus on the tactics and techniques used by attackers during an attack. Both IoCs and IoAs play complementary roles in cybersecurity, where IoCs provide specific indicators to identify compromises, and IoAs provide a broader understanding of the attack techniques employed by adversaries.

It’s important for security teams to leverage both IoCs and IoAs in their defense strategies to enhance their ability to detect and mitigate cyber threats effectively.

Indicators of Compromise (IoCs)

• IoCs are evidence or clues that suggest a system or network was breached or compromised by unauthorized individuals or malicious actors.
• They are typically derived from observed malicious activities, known patterns, or artifacts left behind by attackers.
• IoCs can include indicators such as IP addresses, domain names, file hashes, registry keys, network traffic patterns, or behavioral anomalies.
• Security teams use IoCs to detect, investigate, and respond to security incidents.
• By monitoring and analyzing IoCs, organizations can identify and mitigate the impact of a compromise.

Indicators of Attack (IoAs)

• IoAs focus on the tactics, techniques, and procedures (TTPs) used by threat actors during an attack or attempted breach.
• They are derived from analyzing the behavior and actions taken by attackers as they progress through the different stages of an attack.
• IoAs provide insights into the attacker’s intentions, methods, and potential targets.
• Examples of IoAs include suspicious behaviors like lateral movement, privilege escalation, command-and-control communication, or attempts to exploit vulnerabilities.
• IoAs help security teams detect ongoing or attempted attacks. Even without knowing or unavailable IoCs.
• By understanding IoAs, organizations can proactively identify and respond to attacks before they result in a compromise.

What to do after identifying an IoC

The first step to take after a cyber attack is to isolate the infected computer by removing any connected device. Then, you must contact local authorities. In the case of US residents and businesses, it is the local FBI field office and the Internet Crime Complaint Centre (IC3).

To report a ransomware attack you must gather every information you can about it, including:

• Screenshots of the ransom note
• Communications with Trigona actors (if you have them)
• A sample of an encrypted file

However, if you prefer to contact professionals, then do nothing. Leave every infected machine the way it’s and ask for an emergency ransomware removal service. Restarting or shutting down the system may compromise the recovery service. Capturing the RAM of a live system may help get the encryption key and catch a dropper file. For example, a file executing the malicious payload might be reverse-engineered and lead to the decryption of the data or understanding of how it operates.

You must not delete the ransomware, and keep every evidence of the attack. That’s important for digital forensics so experts can trace back to the hacker group and identify them. It is by using the data on your infected system that authorities can investigate the attack and find the responsible. A cyber attack investigation is not different from any other criminal investigation: it needs evidence to find the attackers.

SalvageData can help you with ransomware removal and data recovery as well as with building a Cybersecurity Business Continuity Plan to prevent cyber attacks.

As soon as you realize you’re a victim of a data breach or cyber attack, contact our ransomware recovery experts.