Technical Intelligence

Question 1

What are common email indicators of compromise (IOCs)?

Answer 1

Sender’s email address, subject line, malicious attachments and links, X-forwarding IP address, X-originating IP address.

Question 2

Why monitor X-forwarding IP addresses in emails?

Answer 2

They reveal the proxy address used to send the email, offering insight into attack infrastructure.

Question 3

Why monitor X-originating IP addresses in emails?

Answer 3

They identify the original IP address of the sender, useful for tracing attackers.

Question 4

What are common network indicators of compromise (IOCs)?

Answer 4

URLs, domain names, IP addresses, user-agent strings.

Question 5

Why are URLs useful as network IOCs?

Answer 5

They are often unique paths used by threat actors for command and control or malware delivery.

Question 6

Why monitor domain names in network traffic?

Answer 6

They can be used for malware delivery and data exfiltration.

Question 7

Why are IP addresses considered short-lived IOCs?

Answer 7

Threat actors frequently change servers or use legitimate cloud IPs.

Question 8

What are common host-based indicators of compromise (IOCs)?

Answer 8

Filenames, file hashes, registry keys, DLLs, mutexes.

Question 9

Why are registry keys important host-based IOCs?

Answer 9

Malware modifies registry settings for persistence.

Question 10

How are DLLs used by threat actors?

Answer 10

They replace system files to ensure malware execution during startup.

Question 11

What is a mutex and why is it used in malware?

Answer 11

A program object used to ensure only one instance of malware infects a host.