CompTIA Security+ Preparation · lesson 14 of 45 · 25 min
Indicators of Compromise — Deep Dive
Security analysts use IoCs to detect, investigate, and respond to breaches. Knowing the categories and examples is essential for Security+ Domain 4.
Network-based IoCs: unusual outbound connections to unknown IPs, traffic on unexpected ports, large data transfers at odd hours, beaconing (regular intervals to C2 server), DNS queries to newly registered domains, traffic to known malicious IPs/domains.
Host-based IoCs: new or modified system files, unexpected processes running, new scheduled tasks or services, registry modifications (Windows), modified startup entries, disabled security tools, new local admin accounts, unusual CPU/memory usage.
Application IoCs: failed authentication spikes, unusual login times or locations, privilege escalation events, access to sensitive files outside normal patterns, new API keys or tokens created.
Log-based IoCs: cleared event logs (a major red flag — attackers clear logs to hide activity), gaps in log data, authentication from unusual locations, multiple account lockouts.
Log Clearing = Major Red Flag
When Windows Security event logs are cleared (Event ID 1102) or System logs are cleared (Event ID 104), this is a strong IoC — legitimate administrators rarely clear logs, but attackers do to cover their tracks.
Threat Intelligence Sharing
STIX (Structured Threat Information eXpression) — JSON-based format for describing threat intelligence: threat actors, campaigns, malware, attack patterns, IoCs.
TAXII (Trusted Automated eXchange of Intelligence Information) — the transport protocol for sharing STIX data between organizations and threat intelligence platforms.
MITRE ATT&CK — knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world observations. Organized by: Tactics (the “why” — initial access, persistence, lateral movement) → Techniques (the “how”) → Sub-techniques.
Threat intelligence feeds — subscriptions to lists of known malicious IPs, domains, file hashes. Used to enrich SIEM alerts and block known threats.
ISACs (Information Sharing and Analysis Centers) — sector-specific organizations for sharing threat intelligence (FS-ISAC for financial, H-ISAC for healthcare, etc.).
Key Terms
Key Terms
Knowledge Check — 10 Questions
Security+ — IoC Deep Dive & Threat Intelligence
Beaconing is a network IoC that indicates:
- Normal web browsing
- Malware communicating with a C2 server at regular intervals
- A DDoS attack
- DNS misconfiguration
- Answer: Malware communicating with a C2 server at regular intervals
Beaconing — regular, periodic outbound connections — is a classic sign of malware checking in with its command-and-control server. Cleared Windows event logs (Event ID 1102) are:
- Normal maintenance
- A major IoC — attackers clear logs to hide activity
- A system error
- A performance optimization
- Answer: A major IoC — attackers clear logs to hide activity
Legitimate admins rarely clear security logs. Log clearing is a strong indicator that an attacker is trying to cover their tracks. MITRE ATT&CK organizes adversary behavior into:
- CVEs and CVSS scores
- Tactics, Techniques, and Sub-techniques
- Malware families and variants
- Network protocols and ports
- Answer: Tactics, Techniques, and Sub-techniques
ATT&CK: Tactics = the goal (e.g., Initial Access), Techniques = how to achieve it, Sub-techniques = specific implementations. TAXII is used for:
- Formatting threat intelligence
- Transporting/sharing STIX threat intelligence between organizations
- Scanning for vulnerabilities
- Encrypting threat data
- Answer: Transporting/sharing STIX threat intelligence between organizations
TAXII is the transport protocol — STIX defines the format, TAXII defines how to share it. An ISAC provides:
- Vulnerability scanning services
- Sector-specific threat intelligence sharing
- Incident response services
- Compliance auditing
- Answer: Sector-specific threat intelligence sharing
ISACs (e.g., FS-ISAC for finance, H-ISAC for healthcare) enable organizations in the same sector to share threat intelligence.
Which is a host-based IoC?
- Large outbound data transfer
- New local admin account created unexpectedly
- DNS query to unknown domain
- Traffic on port 4444
Answer: New local admin account created unexpectedly
Unexpected new admin accounts are a host-based IoC — often created by attackers to maintain persistence.
Threat intelligence feeds provide:
- Real-time vulnerability patches
- Lists of known malicious IPs, domains, and file hashes
- User authentication logs
- Network topology maps
- Answer: Lists of known malicious IPs, domains, and file hashes
Threat feeds are subscriptions to IoC lists — used to enrich SIEM alerts and automatically block known threats. TTP stands for:
- Threat, Target, Protocol
- Tactics, Techniques, and Procedures
- Tools, Tactics, Processes
- Threat, Technology, Prevention
- Answer: Tactics, Techniques, and Procedures
TTPs describe HOW threat actors operate — their goals (tactics), methods (techniques), and specific implementations (procedures).
STIX is a JSON-based format for describing threat intelligence.
- True
- False
Answer: True
STIX 2.x uses JSON to describe threat actors, campaigns, malware, attack patterns, and IoCs in a standardized, machine-readable format.
Multiple account lockouts in a short time period is an example of:
- Normal user behavior
- A log-based IoC suggesting a brute force attack
- A hardware failure
- A network outage
- Answer: A log-based IoC suggesting a brute force attack
Multiple lockouts indicate repeated failed authentication attempts — a classic sign of a brute force or credential stuffing attack.
Previous lesson: Attack surface and attack vectors: network, application, supply chain, human
Back to CompTIA Security+ Preparation
Next lesson: Social engineering: phishing, vishing, pretexting, BEC