Indicator of compromise

As explained in Cyber Threat Hunting

An observable artifact or attribute associated with a system or activity that may indicate malicious compromise.

An indicator of compromise is observable evidence that may reveal malicious activity on a system or help test a threat hypothesis. Indicators guide targeted searches rather than proving a threat by themselves. section 1.3.2 section 1.6

Useful indicators can expose suspicious activity and support repeatable threat-hunting decisions:

• Suspicious encoded PowerShell commands. section 1.3.2
• Unsigned PowerShell scripts executed without warning. section 1.3.2
• Processes with suspicious PowerShell arguments or parent processes. section 1.3.2
• Techniques, procedures, and data sources selected for a specific threat hypothesis. section 2.2.3

Testing a PowerShell hypothesis

A hunter hypothesizes that suspicious PowerShell activity exists. They define the activities and data required, search for indicators, and classify the result as proved, disproved, or inconclusive. If the hypothesis is proved, they search other systems to estimate the attack's spread and share the findings with incident response, monitoring, and threat-intelligence teams. section 1.3.2 section 1.6

Figure 1.3 High-level threat-hunting process

Use the high-level threat-hunting process to place indicator searches within hypothesis formation, proof-seeking, scope expansion, and response handoff. section 1.6

How Cyber Threat Hunting covers it

How deep it goes

Explains indicator selection through examples and hunt-play structure, but stops short of detailed indicator-analysis internals.

Examples

Uses encoded PowerShell, unsigned scripts, suspicious arguments, parent processes, techniques, procedures, and required data sources.

What it assumes

Assumes access to relevant operating-system events, tools, data sources, and threat intelligence while teaching hypothesis testing and indicator selection.

What you can do after

Diagnose/debug potential compromise by selecting indicators, searching available data, judging hypothesis results, and escalating confirmed findings.

How it connects

Connects indicators to threat hunting, hypotheses, threat intelligence, MITRE ATT&CK, incident response, and security monitoring.

liveBookmanning.com

Read Cyber Threat Hunting on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Data-Driven CybersecurityAn indicator of compromise is an observable artifact or behavior suggesting that a system or environment has been compromised.

Compare how 2 books explain indicator of compromise →

Related concepts

• threat-hunting playused by · A repeatable operational procedure for conducting a particular threat hunt and recording its investigative scope and logic.
• postincident analysisused by · Postincident analysis is a structured examination of an incident and its response to understand what occurred, identify causes, and determine improvements or corrective actions.
• information security continuous monitoringuses · Information security continuous monitoring is the ongoing collection and analysis of systems, networks, controls, and activity to maintain security awareness and identify relevant changes, threats, or incidents.

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.