14,952
edits
Changes
Jump to navigation
Jump to search
Line 1:
Line 1: − + + + + + + + + + + + +
no edit summary
A '''Compromised Domain''' has legitimate content elsewhere on the domain or evidence that it was once used for legitimate purposes but now shows signs of [[DNS Abuse]].
A '''Compromised Domain''' has legitimate content elsewhere on the domain or evidence that it was once used for legitimate purposes but now shows signs of [[DNS Abuse]].
==Indicators of Compromise==
==Indicators of Compromise==
Indicators of Compromise (IOC)
Indicators of compromise (IOCs) are forensic evidence of potential intrusions into a host system or network. These artifacts help information security workers and system administrators to detect intrusion attempts and malicious activity. Security researchers use IOCs to analyze [[malware]] techniques and behaviors. IOCs provide actionable, shareable threat intelligence, which the community can use to improve organizations' incident responses and remediation strategies. Some are found on event logs and timestamped entries in a system, applications, or services. They may also be discovered with tools for monitoring and mitigating breaches and attacks.
===Common IOCs==
* Unusual traffic going in and out of the network
* Unknown files, applications, and processes in the system
* Suspicious activity in administrator or privileged accounts
* Irregular activities such as traffic in countries where an organization does not do business
* Dubious log-ins, access, and other network activities that indicate probing or brute force attacks
* Anomalous spikes of requests and read volume in company files
* Network traffic that traverses in unusually used ports
* Tampered files, DNS, and registry configurations and system setting changes, including in mobile devices
* Large amounts of compressed files and data found in locations where they should not be<ref>[https://www.trendmicro.com/vinfo/us/security/definition/indicators-of-compromise#:~:text=Indicators%20of%20compromise%20(IOCs)%20serve,attempts%20or%20other%20malicious%20activities. Indicators of Compromise, TrendMicro]</ref>
==Types==
==Types==
Adversaries hijack domains and/or subdomains to target victims.
Adversaries hijack domains and/or subdomains to target victims.