Questions tagged [indicator-of-compromise]

Filter by
Sorted by
Tagged with
0
votes
0answers
67 views

What's with this seemingly nonsensical Bitcoin “hack” story about a kid with 400 BTC live on his malware-infested PC? [closed]

I read this very strange story yesterday, and I really need to ask about it: Hackers knew that everyone would be staring at the sun and away from their computers, so they chose that precise moment to ...
1
vote
0answers
179 views

How did SolarWinds get hacked? And was the Orion update put out without human approval? [closed]

Obviously there is massive information about the SolarWinds Orion hack itself of the malicious DLL injected into the update: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-...
2
votes
2answers
77 views

What to make of inconsistent TFA/2FA verification emails from AOL

My parents use AOL (there's no point trying to migrate them at this stage) with two factor authentication. My father let me know that he recently received an identity log in verification email that ...
0
votes
0answers
19 views

In Splunk Enterprise Security Intelligence Downloads portion, what exactly does the “Fields” portion mean?

Trying to configure a download of MISP IoCs in Splunk ES, under Intelligence Downloads. It's working for IPs but I can't figure out how to tell Splunk that the feed contains more than just IPs, for ...
0
votes
1answer
168 views

How can I add a MISP STIX feed to LogRhythm?

I have a MISP server set up. I then use a REST API endpoint to get a STIX feed from that server. This portion appears to be working fine. I then try to add that STIX feed to LogRhythms Threat ...
0
votes
0answers
124 views

Logged in with a hacker's email address

I have an active account at ebay-kleinanzeigen.de (like Craigslist in the US). Today I got a valid email from them that my email address was changed. On my mac, I opened up my ebay-kleinanzeigen ...
2
votes
0answers
118 views

Refurbished Samsung Galaxy Watch - check for compromise

I recently purchased a refurbished Samsung Galaxy Watch off Amazon through a third-party seller. Now, a few hours later, it occurs to me that it is possible that the previous owner could have rooted ...
0
votes
0answers
107 views

Threat Hunting Observations : Basic Scoring Jupyter Notebook for Running processes on Windows Operating Systems

I am trying to create a scoring Jupyter Notebook created for Windows Processes and I was wondering about what information would I exactly need to generate a basic Score for each process running on a ...
0
votes
2answers
619 views

On urlscan.io Indicators of Compromise, what do the hashes represent?

When I look up a domain of interest on urlscan.io, I see a lot of interesting information. When I click on "Indicators of compromise" (IOC), I see a list of hashes that are actually links to pages ...
3
votes
4answers
582 views

Indicator of Compromise effective periods [closed]

How long should IOCs be monitored even thou they might be "outdated"? Are there best practices or other reasonings? I would think monitoring IOCs indefinitely is not ideal. Perhaps 90 days would ...