Hunting methods

If you recall, in Chapter 7, Technical Threat Analysis – Enrichment, we discussed how we took our collected data and began to enrich that data by producing IOCs that both identified network infrastructure and also contained IOCs that pertained directly to files and their execution within the operating system. We're going to take this idea just one step further here. While we produced indicators during our analysis of the infrastructure and the execution of the files, it's important to understand that not all indicators that are identified or created are malicious. It's completely up to the researcher who is doing the analysis to create the analytic judgment that identifies an indicator as malicious and, therefore, to categorize that indicator as an IOC, meaning that the indicator identified is, in fact, part of a malicious infrastructure or is doing something to the operating system with malicious intent.

Let's illustrate this. If you remember...