Using indicators of compromise to uncover additional suspect systems
We will now use the indicators of compromise we have found thus far to see whether we can uncover any other systems on our network that might show signs of compromise. Depending on the type of IOC, we will be using the appropriate tool to do a search on our industrial environment.
Discovered IOCs so far
To recall all the indicators of compromise we have found so far, consider the following list:
- IOC-1 – IP address:
222.222.222.222 - IOC-2 – URL:
very-malicious-website.com - IOC-3 – URI:
/serve.html - IOC-4 – User agent:
<host name> <OS version> - IOC-5 – Service name:
IPRIP - IOC-6 – Malware install command:
rundll32.exe <dll-name>Install(A)
Additionally, we can add the location of the IPRIPa.dll file to our list as well as create MD5 and SHA256 hashes from the dll file we extracted (or the one in the c:\windows\temp folder...
