Leveraging indicators of compromise for detection

When developing detections, the concept of indicators of compromise (IoCs) will frequently come up. Threat intelligence sources commonly share information about threats and will often include IoCs, which can take multiple forms. We briefly discussed the concept of indicators in Chapter 1.

In this section, we are going to dive further into the concept of IoCs, the Pyramid of Pain, and how they relate to detections. These concepts will be brought up again in Chapter 8 when we go in-depth into leveraging threat intelligence for detection engineering.

In Chapter 1, we saw that static indicators such as hashes, IP addresses, and domain names are at the bottom of the Pyramid of Pain, and are trivial for adversaries to change. Despite being easy to change, they do provide a method for short-term, tactical defense. When talking about detecting IoCs, this is typically our focus: a quick way to detect known threats until the threat actor...