Indicators of Compromise - CompTIA Security+ SY0-701 - 2.4

Main Ideas / Lessons (Indicators of Compromise — IoCs)

Indicators of Compromise (IoCs) are observable evidence that you can be highly confident a system has been breached or compromised.

IoCs may appear across many telemetry sources, including:

• Network traffic
• File integrity
• DNS changes
• Authentication behavior
• Resource usage
• Availability of services
• File encryption states
• Log patterns
• Log deletion or absence

Attackers often try to maintain access (e.g., preventing patches), move data quietly, and hide evidence (e.g., deleting logs).

Common IoCs Mentioned (and What They May Indicate)

• Unusually large network traffic

  • Example: abnormal volume of transfers on a particular network.
  • May indicate: scanning/exfiltration or other attacker activity.

• File/hash changes

  • Example: stored file hash values change unexpectedly.
  • Suggests: files were modified.

• Geographic mismatch in traffic

  • Example: traffic mostly expected from your own country, but you see a rise from international sites.
  • May indicate: command-and-control or exfiltration from outside your region.

• DNS configuration changes

  • Example: DNS information on servers has been modified.
  • May indicate: manipulation of where traffic is directed.

• Abnormal authentication/login patterns

  • Example: unusual login timing or frequency; “suspicious” authentication behavior.
  • Could mean: credential theft, brute force, or session hijacking.

• Files accessed far more than normal

  • Example: certain files being read much more often than typical.
  • Suggests: discovery/collection behavior.

Method / Key “Indicators Walkthrough” (Detailed)

1. Account lockouts

   • If an account is locked even though the user didn’t trigger it, that can be an IoC.
   • Two described causes:
     • Automatic lockout from too many incorrect password attempts (unlock is then required for legitimate login).
     • Administrative disable (someone disabled the account in management tools).
   • Additional attacker tactic:
     • Attackers may deliberately lock the account so they can impersonate the user and get the password reset via help desk.

2. “Impossible travel” / concurrent logins from distant locations

   • Compare login source locations over time.
   • Example: login from Omaha, Nebraska, then minutes later another login for the same user from Australia.
   • Emphasis: this should be easy to spot in authentication logs, though some cases can be legitimate (e.g., multiple devices, service accounts, automated logins).
   • Practical concept:
     • Use reports showing locations, IPs, and times of access (example mentioned: a Google Mail activity report).

3. Resource consumption / spikes

   • Monitor for spikes in:
     • Traffic volume
     • File transfers between systems
     • Outbound data flows to attacker servers
   • Example: network busier than normal at unusual hours (e.g., 3 AM).
   • Supporting evidence:
     • Firewall logs showing flows, IPs, and time frames.

4. Unavailability of resources

   • Resource failure can be benign, but can also be an IoC.
   • Examples:
     • A server becomes inaccessible because an attacker attempted to exploit a vulnerability and caused a crash.
     • Network segments are disrupted because attackers are causing instability to support other exploitation.

5. Encrypted file systems / ransomware behavior

   • If accessed file system data suddenly appears encrypted/unavailable, it likely indicates ransomware infection.
   • Related earlier concept:
     • If you can’t log in and accounts are locked, attackers may have performed brute-force attempts.

6. Excessive logging of unexpected events (“out-of-cycle logging”)

   • Logs can reveal activity that violates expected operational schedules.
   • Example: if your organization installs patches regularly via Change Control, then patches/app installs outside expected windows may indicate compromise.
   • Firewall emphasis: firewalls log traffic flows extensively, enabling detection of data transfers at unusual times.

7. Missing logs / log deletion

   • Attackers may delete logs to hide their actions.
   • Since attackers rely on leaving traces (auth, file transfer, firewall traversal), the absence of logs can be suspicious.
   • Best-practice action:
     • Create reporting from logs and set notifications/alerts when expected logs are missing.

8. Data exfiltration revealed on the public internet

   • A major IoC:
     • Private organizational data suddenly becomes publicly available.
   • Common associated pattern:
     • Attackers may exfiltrate data, then use ransomware/extortion:
       • Encrypt data
       • Leak/release data publicly unless payment is made
   • After discovery:
     • Researchers may analyze leaked data to determine where it came from and who the original owner is.

Speakers / Sources Featured

• No specific named speakers are identified in the provided subtitles.
• Referenced sources/tools (not necessarily speakers):
  • Google Mail (Gmail) account activity report (used as an example of viewing login locations/times)
  • Firewall logs (described as a key data source)