Network IOCs – blocking at the perimeter
Some of the most powerful IOCs we uncover as analysts are those that are network-based. FQDNs, IPs, and other network-bound indicators are often utilized to control malware, attack machines, or download secondary stages that often contain the code meant to perform actions on objectives on our network – be that ransomware or otherwise.
The best solution we have to acting on these IOCs is certainly to block them at the network perimeter – at the egress point where the workstation attempts to call out to the known malicious IP, drop the packet, and pass the event to the SIEM stack to log and alert the SOC accordingly.
However, there are also considerations that we can take on workstations themselves via Group Policy or server configuration.
One of the ways we could go about this is to manually block outbound connections to the IP via the same firewall configuration tool that we utilized in the previous section. However...
