In this lesson, we will discuss
some common indicators of compromise
in the world of cybersecurity,
indicators of compromise, commonly referred to
as IoCs are pieces of forensic data that identify
potentially malicious activity on a network or system.
These IoCs serve as the digital evidence
that a security breach has occurred.
These indicators of compromise include things
like account lockouts and current session usage
blocked content, impossible travel, resource consumption.
Resource inaccessibility, out of cycle logging,
publish says documenting that you've been hacked
and missing logs.
First, we have account lockouts.
An account lockout is a common indicator
of compromise that occurs when an account has been locked
out due to multiple failed login attempts.
This could indicate a brute force attack that was attempted
by the hacker who was trying to gain access
by guessing the user's password.
For example, if an account is locked
out after numerous unsuccessful login attempts
in a short period, it is usually a clear sign
that someone is trying to break into the account.
Account lockout policies vary among different systems.
Some systems may lock out an account
after a certain number of attempts of failed logins
while others may increase the delay between login attempts
after each failure to effectively slow down the attacker
and make a successful brute force attack much
more impractical.
The duration of the account lockout will also
vary depending on your system.
Some systems may implement a temporary lockout
where the account is automatically unlocked
after a certain period of time
such as 15 minutes or four hours, or some time-based reset.
Other high security systems may require a
manual intervention
by an administrator to unlock the account to ensure
that the suspicious activity is investigated prior
to the account being unlocked.
While account lockout is a valuable security feature
it must be balanced with usability.
Overly strict account lockout policies can lead
to increased support calls and frustrated users.
For example, if an account is locked
after three failed attempt, a user could be locked
out simply by mistyping their password.
So it's important to weigh the security benefits
against the possible user inconvenience
that a low lockout threshold may create.
Second, we have concurrent session usage.
Concurrent session usage refers
to multiple active sessions from a single user account.
This could indicate that the account has been compromised
and it's being used by attacker
while the legitimate user is logged in.
For example, if an employee is logged into their account
from their office computer, but another session
from a different location is active at the same time
it's a strong indication of a security breach.
In this example, it could have been a false positive
since an employee could be logged in from different devices.
However, exercising caution is important here because
if one session is in the United States
while the other active session is happening from Europe
then it is a good sign that a compromise has occurred.
Third, we have blocked content.
Blocked content is another indicator
of compromise that refers to attempts to access
or download content that has been blocked
by security protocol.
This could indicate a user trying to
access malicious content
or an attacker trying to download sensitive data.
For example
if there are repeat attempts to download a blocked file
it could suggest that a user's account has been compromised
and is being used to steal data.
Fourth, we have impossible travel.
Impossible Travel is a unique indicator
of compromise that involves detecting logins
from geographically distant locations
within a specific timeframe that makes physical travel
between those locations impossible to achieve.
For example, if a user account logs in from New York
and then from London within an hour, there's a good chance
that an account compromise has occurred
because a single user cannot travel from New York
to London in less than five or six hours by taking a plane.
Often you will see impossible travel
and concurrent sessions usage grouped together
since they often but not always occur simultaneously.
Fifth, we have resource consumption.
Unusual spikes in resource consumption such
as CPU, memory or network bandwidth can serve
as a good indicator of compromise.
This excessive resource utilization can indicate a
malware infection or a distributed to denial service attack
or DDoS attack that is concurrently underway.
For example, if a server that typically uses 20%
of a CPU capacity and then suddenly jumps to 90%
it could be a good sign
that the server is under attack or has been compromised.
Another example would be if you're browsing the web
on your workstation and your GPU usage is at 90%
this is a good indication
that the system may be a zombie and has been enrolled
as a crypto mining agent or performing some other kind
of computational resource heavy task for a threat actor
both of which have become very popular attacks
in the recent years.
Six, we have resource inaccessibility.
Resource inaccessibility refers
to the inability to access certain resources such
as files, databases, or network services.
This could indicate a ransomware attack where
an attacker encrypts a victim's files
and demands a ransom for their release.
For example, if a user suddenly cannot access
these files and receives a ransom note
this is an obvious and clear sign that they're
a victim of a ransomware attack.
Seventh, we have an out-of-cycle logging.
Out-of-cycle logging refers to log entries that
occur at unusual times such as late nights or
on weekends where no one is expected to be working.
This type of out-of-cycle logging usually indicates
that an attacker is trying to hide their activities
during off peak hours.
For example, if their log entry show activity at
3:00 AM when office is typically closed, this could
suggest that a security breach has occurred on the network.
Eight, we have missing logs.
Missing logs, like out-of-cycle logging is another sign
that a compromise has occurred.
Attackers often delete to hide their activities
and make it harder for investigators to trace their
attackers footsteps through the network.
For example, if a systems log suddenly have a gap
of several hours or days, this might suggest
that an attacker has been tampering with the logs to
cover their tracks.
Ninth and finally, we have published articles or documents
that your organization has been hacked.
Sometimes an attacker will publicly disclose
that they hacked the system either to boast
about their skills or cause reputational damage
to the organization.
This type of publishing can occur on social media
hacker forums
in a newspaper article, or even on a victim's own website.
For example, if a company's website is defaced
with the message claiming
that the Hacktivism group was responsible for the attack
this is obviously a clear sign
that your website has been compromised.
So remember, recognizing these indicators
of compromise is crucial
to your success as a cybersecurity professional.
Indicators of compromise are the evidence
includes left behind by a threat actor
that can provide us insights
and some early warning signs of potential breaches so
that we can act swiftly to contain and mitigate any damage.
However, it's important to remember
that not all indicators of compromise necessarily means
that a compromise has occurred.
Instead, there are hints or clues
that something has happened
and it's still up to us to decide
if it is a true compromise or if it was simply the result
of a system error or it was a legitimate user activity
or it is simply a false positive.
For this reason, you will spend a lot
of your time as a cybersecurity professional combing
through event logs to determine
if an event was really part of a compromise or not.