What are Indicators of Compromise?

The Difference Between Indicators of Compromise (IOCs) and Indicators of Attack (IOAs)

Indicators of compromise (IOCs) and indicators of attack (IOAs) are similar, in that they are both signs of potentially malicious activity. However, IOCs focus more on forensic analysis following a security incident, whereas IOAs help organizations identify the potentially malicious activity as it occurs. Security teams must continuously monitor the event logs for both IOCs and IOAs, if they are to mitigate cyber-attacks.

Examples of Indicators of Compromise

Below are some of the common activities to look out for that may indicate that a security incident has, or is, unfolding:

Unusual network traffic

Network traffic can be monitored by security teams for anomalous patterns to help prevent data breaches. For example, suspicious outbound network traffic might suggest that an attacker is trying to exfiltrate data.

Anomalies in privileged user account activity

Failed login attempts, out-of-hours access, access via unrecognized devices and locations, and users attempting to elevate their privileges, are just some of the IOCs and IOAs we can look out for that are associated with privileged user accounts.

Increases in database read volume

Unusual increases in your database read volume may imply that an adversary is trying to perform a database dump.

HTML response sizes

If Hypertext Markup Language (HTML) response sizes are larger than normal, this could be a sign that an attacker is trying to steal your data.

Large numbers of requests for the same file

If an attacker is trying to steal a specific file, they may try numerous different ways to obtain it. If your security team detects multiple requests for the same file, this could be an IOC/IOA.

Mismatched port-application traffic

Applications rely on ports to exchange data with a network. Certain hacking tools and even some types of malware will try to leverage obscure ports to either access the network or exfiltrate data.

Suspicious registry or system file changes

In some cases, malware will make changes to registry or system files. Establishing a baseline will help security teams monitor for such changes.

Unusual DNS requests

Adversaries will frequently make use of command-and-control (C&C) servers to exfiltrate data from a network. Domain Name System (DNS) requests that come from an unknown host could be signs of an IOC. Likewise, excessive DNS requests could be signs of a Distributed Denial of Service (DDoS) attack.

Anomalous file activity

Attackers may try to transfer a large number of files to their C&C server, or, in the case of a ransomware attack, the malicious script will try to encrypt the files on your network. A real-time file auditing solution will establish a baseline that represents typical file usage patterns. This baseline can be tested in order to identify IOCs and IOAs. It’s worth noting that some sophisticated auditing solutions can detect and respond to events that match a pre-defined threshold condition, which can help to identify ransomware attacks and other attack vectors that perform repetitive actions. For example, if x number of files are encrypted within a given time-frame, a custom script can be executed which can disable a user account, stop a specific process, change the firewall settings, or shut down the affected server.

How Lepide Can Help Detect Indicators of Compromise and Indicators of Attack

Lepide gives organizations the ability to detect anomalous user behavior when it comes to interactions and changes being made to sensitive data and critical infrastructure. Lepide establishes what normal user behavior looks like over a given learning period, and then sends real-time alerts to administrators whenever any deviations from the norm take place.

Lepide comes with hundreds of pre-defined threat models specifically designed to detect indicators of attack related to common security threats, such as ransomware, brute force attacks, and compromised user accounts. For example, if a user account were to modify the extension name of 500 files in 30 seconds, it could be an indication that the account has been hijacked for an ongoing ransomware attack. Similarly, if hundreds of account lockouts are taking place over a very short period of time, it could indicate a brute force attack.

Lepide is also able to provide forensic investigation capabilities through a detailed audit log so that administrators can perform scans for indicators of compromise. For example, Lepide analyzes the effective permissions of users and then determines, based on their data usage patterns, whether those access rights are excessive.

If you’d like to see how the Lepide Data Security Platform can help you spot indicators of compromise and indicators of attack, schedule a demo with one of our engineers.