Infrastructure-based IOCs

Analyzing, enriching, and understanding malicious infrastructure is valuable when you're creating actionable intelligence that is timely, actionable, and relevant. Malicious infrastructure can originate from virtually anywhere, including logs, OSINT feeds, and blocklists.

When you're analyzing malicious infrastructure, there are many ways to enrich and analyze infrastructure-based IOCs. In terms of the specifics, we'll focus on three primary datasets that we extract intelligence value from – DNS, WHOIS, and passive DNS. When analyzed individually, these three datasets and their data often do not indicate maliciousness directly. However, when analyzed together, intelligence and maliciousness are often more easily understood and determined.

Each dataset provides analytical value, as we'll see in the following subsections.

Domain Name System (DNS)

The Domain Name System (DNS) is a foundational concept in computer networking...