Instructor: Host-related IOCs 2 2
or indicators of compromise. 3 3
Now, there are many contexts 4 4
for analyzing indicators of compromise, or IOCs, 5 5
including instant response, forensic investigations, 6 6
and proactive threat hunting, as we've discussed before. 7 7
Now, in the last section, 8 8
we focused on network-related IOCs, 9 9
but in this section, we're going to focus 10 10
on host-related indicators of compromise. 11 11
Now, what exactly do we consider a host? 12 12
Well, for the purposes of this section, 13 13
we're really going to focus on the world's most popular hosts, 14 14
Windows-based computers, laptops, and tablets. 15 15
Now, while it's true that things like smartphones, tablets, 16 16
and other devices can be considered hosts, 17 17
we really are going to be focused more on Windows, 18 18
and to some extent, Linux in this section 19 19
due to their popularity as workstations and servers 20 20
in the business environment. 21 21
In a later section, 22 22
we're going to cover mobile IOCs separately 23 23
because those are going to rely on different operating systems 24 24
and different tools to analyze them. 25 25
So in the rest of this section, 26 26
we are going to focus on the different ways 27 27
of identifying bad behavior on a given host. 28 28
Essentially, we need to find an indicator of compromise, 29 29
which we define as a sign that an asset has been attacked 30 30
or is currently under attack. 31 31
Now, once we find an indicator of compromise, 32 32
we can then use that IOC to create defenses 33 33
against these attacks, 34 34
and we can use them in our threat hunting. 35 35
These indicators of compromised can help us identify 36 36
the presence of malware on a host, 37 37
whether unauthorized accounts 38 38
and permissions have been created, 39 39
and if the files have been accessed or exfiltrated. 40 40
So let's start identifying these IOCs 41 41
by examining system memory, the file system, 42 42
and the operating system logs on a given host.