Collecting Indicators of Compromise

When to Use

• During active incident response to identify and block adversary infrastructure
• Post-incident to document all observed adversary artifacts for future detection
• When sharing threat intelligence with ISACs, sector partners, or law enforcement
• When building detection rules in SIEM, EDR, or network security tools
• When enriching IOCs with threat intelligence context for risk scoring

Do not use for behavioral TTP analysis without accompanying technical indicators; use MITRE ATT&CK mapping for behavioral characterization.

Prerequisites

• Access to incident evidence sources: SIEM logs, EDR telemetry, memory dumps, disk images, network captures
• Threat intelligence platform (MISP, OpenCTI, ThreatConnect) for IOC management and sharing
• IOC enrichment tools: VirusTotal, OTX (AlienVault Open Threat Exchange), Shodan, DomainTools
• STIX 2.1 knowledge for structured IOC representation
• Sharing agreements with relevant ISACs (FS-ISAC, H-ISAC, IT-ISAC) or sector partners

Workflow

Step 1: Identify IOC Categories

Collect indicators across all categories from incident evidence:

Network Indicators:

• IP addresses (C2 servers, staging servers, exfiltration destinations)
• Domain names (C2 domains, phishing domains, DGA domains)
• URLs (malware download, C2 check-in, exfiltration endpoints)
• JA3/JA3S hashes (TLS client/server fingerprints)
• User-Agent strings (custom or unusual HTTP headers)
• DNS query patterns (tunneling signatures, DGA patterns)

Host Indicators:

• File hashes (MD5, SHA-1, SHA-256 of malware, tools, scripts)
• File paths (known malware installation directories)
• Registry keys (persistence mechanisms, configuration storage)
• Scheduled tasks and service names (persistence)
• Mutex/event names (malware instance synchronization)
• Named pipes (C2 communication channels, e.g., Cobalt Strike)

Email Indicators:

• Sender addresses and domains (spoofed or attacker-controlled)
• Subject lines and body content patterns
• Attachment names and hashes
• Embedded URLs
• Email header anomalies (SPF/DKIM/DMARC failures)

Step 2: Extract IOCs from Evidence Sources

Systematically extract indicators from each evidence source:

From SIEM/Log Analysis:

# Extract unique destination IPs from firewall logs
index=firewall action=blocked
| stats count by dest_ip
| where count > 100

# Extract domains from DNS query logs
index=dns query=*evil* OR query=*c2*
| stats count by query

From Memory Forensics:

# Extract network connections
vol -f memory.raw windows.netscan | grep ESTABLISHED

# Extract strings from suspicious process memory
vol -f memory.raw windows.memmap --pid 3847 --dump
strings -n 8 pid.3847.dmp | grep -E "(http|https)://"

From Malware Analysis:

Sandbox Report IOC Extraction:
- Dropped files:      3 (hashes extracted)
- DNS queries:        update.evil[.]com, cdn.malware[.]net
- HTTP connections:   POST to https://185.220.101[.]42/gate.php
- Registry modified:  HKCU\Software\Microsoft\Windows\CurrentVersion\Run\svcupdate
- Mutex created:      Global\MTX_0x1234ABCD
- Named pipe:         \\.\pipe\MSSE-1234-server

Step 3: Enrich IOCs with Context

Add threat intelligence context to each indicator:

IOC Enrichment Report:
━━━━━━━━━━━━━━━━━━━━━
IP: 185.220.101.42
  VirusTotal:     12/89 vendors flag as malicious
  Shodan:         Open ports: 443, 8443, 80
  Geolocation:    Netherlands, AS208476
  First Seen:     2025-10-01
  Threat Intel:   Associated with Qakbot C2 infrastructure
  Confidence:     High
  TLP:            AMBER

Domain: update.evil[.]com
  Registration:   2025-10-28 (recently registered)
  Registrar:      Namecheap
  WHOIS Privacy:  Yes
  VirusTotal:     8/89 vendors flag as malicious
  DNS History:    Resolved to 185.220.101.42, 91.215.85.17
  Confidence:     High
  TLP:            AMBER

Step 4: Score and Prioritize IOCs

Assign confidence and risk scores to each indicator:

…