Summary

In this chapter, we've discussed several ways that we may put the IOCs we have painstakingly collected in previous chapters to use, and leverage these to prevent further incidents within our environment – or simply create chokepoints for the adversary and address them as the Spartans did to the Persians at the gates of Thermopylae, though hopefully with a modicum more success.

We've reviewed ways we can utilize the power of in-built Windows tools such as Group Policy or Active Directory's in-built DNS mechanisms in order to limit the adversary's reach to download secondary payloads, execute files, or move laterally within the network.

We have also established that while these methodologies exist, perhaps the best methodology possible for implementing IOCs in the most effective way possible is to utilize a purpose-built piece of software, as is often the case with tools of one's trade.

In the next chapter, we'll take a look at taking...