Host and Network based Indicators

ndicators of compromise (IOCs) are pieces of information that can be used to identify malicious activity or detect security incidents on a network or host. There are two main types of IOCs: host-based indicators and network-based indicators. Here are some examples of each:

Host-Based Indicators:

1. File hashes: Unique hashes of malicious files can be used to identify the same file across multiple systems.
2. File names and paths: Suspicious file names and paths can be used to identify potentially malicious files on a host.
3. Registry keys: Changes to the Windows registry can indicate the presence of malware on a host.
4. Running processes: Suspicious or unusual processes running on a host can indicate the presence of malware or other malicious activity.
5. System logs: Anomalies or suspicious entries in system logs can indicate the presence of malicious activity.

Network-Based Indicators:

1. IP addresses: Suspicious or known malicious IP addresses can be used to identify network traffic associated with malware or other malicious activity.
2. Domain names: Suspicious or known malicious domain names can be used to identify network traffic associated with malware or other malicious activity.
3. URL paths: Suspicious or known malicious URL paths can be used to identify network traffic associated with malware or other malicious activity.
4. Network signatures: Unique signatures of network traffic associated with malware or other malicious activity can be used to detect the same activity across multiple systems.
5. DNS requests: Anomalies or suspicious DNS requests can indicate the presence of malware or other malicious activity on a network.