Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ioc]

The tag has no usage guidance.

0
votes
2answers
123 views

How do I list IP addresses a system is connecting to from its memory dump or OS image (obtained from FTK Imager)? [on hold]

I'm looking for a tool that will enumerate the IP addresses that a system is connecting to. This is mainly for forensic purposes, to gather IOCs. I know we can run a netstat on windows, but would like ...
-1
votes
0answers
41 views

Threat hunting IOC's (threat) Classification?

For threat hunting purposes, i need to find a way to classify IoC's (indicators of compromission) or in a more general the "threats" so when starting a threat hunting mission for a client i know what ...
1
vote
0answers
76 views

sandboxing IoCs and signatures

Sandboxes are used for automated extraction of indicators of compromise (IoCs) that can be used to write signatures. Can this signature then be used, for example, on an IPS system to block certain ...
3
votes
4answers
186 views

Indicator of Compromise effective periods [closed]

How long should IOCs be monitored even thou they might be "outdated"? Are there best practices or other reasonings? I would think monitoring IOCs indefinitely is not ideal. Perhaps 90 days would ...
1
vote
1answer
194 views

When to model a concept via object vs taxonomy vs galaxy in MISP?

Taxonomies in MISP are a triple of (namespace, predicate, value) referred to as "machinetags". Galaxies seem to be similar. The MISP galaxy docs state that MISP galaxy is a simple method to ...
2
votes
1answer
352 views

What is an indicator of compromise?

I'm struggling to understand what is an indicator of compromise. I found different definitions on the web but I still don't know. The definitions I found are: 1 - Something (file, network connection) ...
1
vote
1answer
192 views

Indicator of Compromise - Mozilla Firefox - Malware Redirect [closed]

I am having a strange issue where dragging and dropping an email onto a Mozilla Firefox window redirects the first tab to one of several websites, and the second tab opens with some text from the ...
-1
votes
1answer
303 views

How to read command line argument for potential issue

I have a IOC that has a command line argument that looks like this below. Wanted to see if someone could help me parse it out a little bit to understand what is happening. C:\Windows\System32\mshta....
1
vote
0answers
232 views

RegistryItem IndicatorItems in OpenIOC - what levels are required

I have seen people specify RegistryItem/KeyPath, RegistryItem/ValueName, RegistryItem/Value to fully specify the value of a registry entry, and others just use RegistryItem/Path, RegistryItem/...
-1
votes
1answer
225 views

indicators of compromise via email servers

Malicious files are commonly infiltrated on to the network via email attachments. Besides awareness and education to my staff to refrain from clicking on suspicious attachments, I would also like to ...