中发现的上下文信息片段 法医分析 that serve to alert analysts of past/ongoing attacks, network breaches, or malware infections. 这些独特的线索-或工件-通常被视为恶意使用的IP地址, url, 域, 或散列. It certainly helps to be alerted to an IOC so that you know something has potentially gone wrong, 但国际石油公司往往缺乏能够赋予企业权力的背景 安全运营中心(SOC) 优先考虑并迅速采取行动以确保漏洞的安全.
尽管首字母缩略词IOC在网络安全社区广泛使用, the phrase “indicator of compromise” generally means any type of 威胁情报 that could indicate something out of the ordinary. 除了上面提到的那些, 通常由IOC确定的场景包括网络流量的变化, ransomware攻击, or 身份和访问管理(IAM) 异常.
When systems signal themselves with activity that lies outside of the normal baseline range, contextual information can help teams to define the type of potential attack 和 refine security operations like anti-malware procedures 和 devices, 改动 SIEM 配置，并进行更彻底和有效的调查.
事实上, 根据Forrester, many cybersecurity vendors are now disseminating IOC security intelligence feeds into many enterprise functions. This helps to natively spot IOCs within a security tool as opposed to using a separate IOC feed.
识别ioc的过程是一个仔细研究分析和分析的过程 威胁情报 识别异常行为，可能是邪恶的-或者可能什么都不是. Again, analysts 和 investigators will need to rely heavily on context to make significant headway.
也就是说, not all processes to identify early indicators of a pending compromise will be the same or even similar. 它们将是特定于业务和用例的. 让我们来看看一些更常见的IOC识别方法:
因为国际石油公司本质上是线索——在一些之后 数字取证 工作指向一些邪恶的东西，他们可以有很多形状和大小. 让我们来看看一些能够并且应该敲响警钟的ioc的例子:
在ioc和攻击指示器(ioa)之间有几个重叠的概念。. 然而, it helps to zoom in on key differences to underst和 why analysts would define an issue as either an IOC or IOA.
我们之前已经讨论过工件，但是添加一些上下文可能会有所帮助. 文物通常是历史性质的. 它们是已经发生的恶意事件的数字足迹, 并且是通过表演被发现的 威胁狩猎 基于特定的智力. Security analysts 和 threat hunters can also leverage outside artifact libraries to familiarize themselves with what to look for on their own networks.
After artifacts are found 和 determined to indicate a potential breach or ongoing threat, 团队可以将事件响应计划付诸实施. 安全从业者可以更快地了解到已经发生了妥协, 他们就能越快确定到底发生了什么, 回应, 和 – hopefully – have a better idea of the kinds of artifacts to look for in the future.
ioa有助于将攻击排除在组织的历史之外. 这些迹象表明，袭击可能迫在眉睫. 有了ioa，团队可以采取更多的进攻姿态，采取行动 扩展检测和响应(XDR) threat telemetry that goes beyond the network perimeter as attack surfaces stretch even further.
解释正确, IOAs不仅可以帮助团队应对未来或正在进行的违规行为, 它们还可以帮助预测攻击者可能会做什么以及他们下一步可能去哪里. This can be incredibly helpful in prioritizing response 和 remediation efforts based on the systems being targeted 和 data attempting to be accessed 和/or exfiltrated.
国际石油公司的好处有很多. Primary among them is they can help companies remediate breaches 和 perhaps provide context on the types of attacker behavior to look for in the future. 让我们来看看其他几个:
国际石油公司对于有效的石油开采至关重要 管理检测和响应(MDR) program because it’s critical for an MDR provider to be able to identify IOCs across their entire customer ecosystem.
这有助于提供者发现攻击者行为的趋势, 在发现ioc时建立网络检测, 定制事件响应计划, 和 disseminate that information to their customer base so that those individual security organizations can implement IOC data into their own prevention technologies.
It’s also important for MDR programs to consider the efficiency gains 和 cost savings that can come with leveraging IOCs to inform breach response. 客户满意度也是一个增长动力, particularly after successful implementation of an MDR provider-recommended plan or after a provider has automatically tested IOCs 和 applied them to customer logs to create alerts when those indicators pop up in their networks.
所有这些因素结合起来有助于MDR提供商留住客户, 改善自身运营, 并通过分享发现来加强更大的安全社区.