Maximizing IOC Impact
Brief
I’ve been thinking about threat intelligence lately. Specifically: indicators of compromise (IOC), how and where to share them to cause maximum pain to adversaries and help as many organizations as possible protect themselves.
I regularly analyze malware traffic from sandboxes such as ANY. RUN , Triage , JoeSandbox and Hybrid Analysis . Pulling fresh PCAPs is an easy way to find malware command-and-control (C2) traffic to previously unknown C2 servers. This method can even reveal new and unreported C2 protocols. I often use CapLoader and NetworkMiner to extract network IOCs, such as:
- Domain names
- IP:port
- URIs
- JA3 / JA3S hashes
- JA4 fingerprints
- X.509 certificate thumbprints
- packet pattern/signature
These indicators can be found in the lower sections of David J. Bianco’s pyramid of pain .