Sandboxes are used for automated extraction of indicators of compromise (IoCs) that can be used to write signatures. Can this signature then be used, for example, on an IPS system to block certain actions?

  • It depends on the IoC, the action, the signature and the IPS, but yes. Can you expand on which part you were curious about? The IPS part, the blocking part, the action part? – schroeder Nov 22 '18 at 13:36
  • My confusion is that you could read the news, determine an IoC from the article, then configure an IPS to block that action. – schroeder Nov 22 '18 at 13:39

IOCs are breadcrumbs attackers leave and organizations gather up to share with each other. There are atomic indicators in an IOC like IP, port #, username, filename, etc that you can configure your IPS to reject.

There are host-based or network-based indicators. Because of all the types of IoCs, your IPS won't be the only tool you use to guard against attacks, though a good one of course.

This article from FireEye on OpenIOC will help anyone who wants to better wrap their mind around the types and parts of an IOC, using this framework as a specific example.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.