Chapter 9: The Reverse Card: Weaponizing IOCs and OSINT for Defense

In every previous chapter of this book, we've looked at analyzing malware from both static and dynamic perspectives. The entire point of the analysis of adversarial software is to gather intelligence on an adversary's operations and find the fingerprints they may leave on a network, machine, or file.

However, simply gathering the information is not enough if we do not endeavor to make use of information our hard-fought analysis has uncovered. While, as analysts, we may not often be responsible for the implementation of these defenses, having the knowledge of how they may be implemented may assist us with knowing what will be of value to uncover during our analysis.

Let's take a look at some of the common uses of the Indicators of Compromise (IOCs) we have already been able to uncover, and how they may be of use to prevent further instances of attack by the same adversary. In this chapter, we&apos...