Indicators of Attack (IoA) and Indicators of Compromise (IoC) are two important concepts in cybersecurity used to detect threats and respond to security incidents. Though they sound similar, there are some key differences between IoA and IoC that are important to understand.
What are Indicators of Attack (IoA)?
Indicators of Attack (IoA) refer to patterns of behavior or suspicious activity that may indicate an attacker is attempting to compromise a system or network. IoAs focus on the tactics, techniques, and procedures (TTPs) that attackers use when targeting a system.
Some examples of IoAs include:
- Large volumes of data being exfiltrated from the network
- Attempted login failures from unknown IP addresses
- Anomalous activity on user accounts
- Unknown processes running on systems
- Connections to known malicious IP addresses
IoAs are often focused on the early stages of an attack, before any real damage has been done. By detecting these sorts of suspicious behaviors, defenders can respond quickly to interrupt an attack before the adversary achieves their objectives.
What are Indicators of Compromise (IoC)?
Indicators of Compromise (IoC) refer to forensic evidence or artifacts left behind by attackers that show a system has been successfully compromised. IoCs focus on the outcomes of an attack, rather than the behaviors leading up to it.
Some examples of IoCs include:
- Presence of malware files or binaries
- Registry key changes made by malware
- Files or folders created by malware
- Malicious domain names contacted by the infected host
- IP addresses beaconing out from compromised systems
IoCs provide definite evidence that an attack was successful and a system is compromised. Defenders use IoCs during incident response to determine the scope of an intrusion by identifying affected systems andassets.
Key Differences Between IoA and IoC
Here are some key differences between Indicators of Attack (IoA) and Indicators of Compromise (IoC):
| IoA | IoC |
|---|---|
| Focus on attack behaviors and tactics | Focus on evidence of compromise |
| Aim to detect attacks in early stages | Aim to assess damage after attack succeeds |
| Example: Attempted login failures | Example: Presence of malware files |
| Used for attack detection and prevention | Used for incident response and scoping |
In summary, IoAs aim to detect attacks in progress, while IoCs are used to analyze successful breaches after the fact. IoAs and IoCs are complementary and both are important for security.
What are examples of IoAs?
Here are some common examples of Indicators of Attack (IoAs) that may signal malicious activity on a network:
- Attempted brute force login attacks – Repeated login attempts with different passwords against user accounts, indicating an attacker is trying to guess passwords.
- Anomalous outbound network traffic – Unusual spikes in outbound traffic could indicate an attacker exfiltrating data from the network.
- Access attempts against multiple systems – An adversary scanning for vulnerable systems and trying to move laterally between assets.
- Suspicious PowerShell commands – Attackers often use PowerShell for execution of malicious code and activity.
- Connections to malicious domains – Traffic to domains known to be associated with command and control servers or malware.
- Propagation of rogue scanning activity – Infected hosts attempting to scan and compromise additional systems.
- Suspicious registry or system file changes – Tampering with registry keys or files that could indicate malware installation or persistence mechanisms.
Detecting these types of behaviors can allow defenders to identify attacks in their early recon and delivery phases, and respond appropriately to prevent breaches.
What are examples of IoCs?
Here are some examples of common Indicators of Compromise (IoCs) that provide evidence of a successful security breach:
- Presence of malware files or binaries – Malicious executables, scripts, droppers, or installers left on disk by attackers.
- Malicious code injected into processes or memory – Code injection indicates active malware running on the system.
- Registry edits or new autorun keys – Changes made to facilitate malware persistence upon reboot.
- Suspicious accounts created – Adversaries often create new privileged accounts for lateral movement.
- Modifications of critical system files – Alterations to files like hosts files that suggest compromise.
- C2 beaconing activity – Observed connections to known command and control IP addresses or domains.
- Exfiltrated documents and files – Attackers often steal documents and data from compromised hosts.
Identifying these IoCs allows incident response teams to quickly determine impacted hosts, assess damage, and scope the overall breach. IoCs provide the evidence needed to confirm a successful intrusion.
How are IoAs and IoCs used in security monitoring?
IoAs and IoCs both play important roles in security monitoring, threat detection, and incident response:
- IoAs for threat detection – Security teams configure rules and analytics to detect IoAs and alert when suspicious activity occurs. This enables early threat interruption.
- IoCs for incident scoping – When an incident occurs, IoCs are identified on compromised hosts to determine the impact and scope of the breach across the environment.
- IoAs to find related activity – IoAs associated with an incident can be used to search for other systems exhibiting similar behaviors across the network.
- Blocking based on IoCs – Blocklists can be generated from compromised IP addresses, domains, file hashes, etc. to prevent further communication with malicious infrastructure.
Overall, IoAs help identify attacks proactively, while IoCs support efficient response and containment when incidents occur. Security teams utilize both throughout the attack lifecycle to rapidly detect, contain, and remediate threats.
What are common sources of IoCs?
Some common sources that security teams use to collect Indicators of Compromise include:
- Threat intelligence feeds – Commercial and open source threat intel provides huge volumes of observed IoCs from global attacks and campaigns.
- Malware analysis – Reverse engineering malware samples reveals IP addresses, domains, files, registry keys and other IoCs contained in the code.
- Incident response – Analysis of compromised systems provides IoCs found within hosts, network traffic, logs, etc.
- Sandboxes – Executing malware samples in sandboxes surfaces the behaviors and artifacts generated during execution.
- SIEM detection rules – Effective security monitoring rules generate IoCs that can be added to blocklists.
- Security research – Bug bounty programs, penetration testing, and red teams yield valuable IoCs associated with vulnerabilities and exploits.
By gathering IoCs from these sources into centralized intelligence platforms, defenders can leverage huge volumes of threat data to hunt for malicious activity and block known threats.
What are common sources of IoAs?
Some common sources that provide Indicators of Attack (IoAs) for security monitoring include:
- Network traffic analysis – Identifying anomalies and suspicious patterns in network flows and protocols.
- Log review – Careful examination of event logs from hosts and security tools.
- Endpoint detection – Agents on hosts detect local suspicious process behavior and events.
- Attack frameworks – MITRE ATT&CK and similar frameworks enumerate common attacker TTPs that can be modeled as detection rules.
- Threat intelligence – IoAs are sometimes shared alongside IoCs within threat intel feeds.
- Security operations experience – Skilled analysts document suspicious behaviors they’ve observed during attacks.
By identifying patterns from these sources, defenders can develop analytics tailored to detect the tactics, techniques, and procedures used by adversaries targeting their specific environment.
How can machine learning help generate IoAs?
Machine learning has emerging use cases for helping automatically generate Indicators of Attack (IoAs):
- User behavior analytics – ML detects anomalies in user activity that could signal account misuse or compromise.
- Network traffic analytics – Unsupervised ML identifies statistical outliers in network patterns that may be malicious.
- Log analysis – ML models learn “normal” log patterns and flag anomalous events.
- Threat hunting – Supervised models can be trained to distinguish between benign and malicious sample behaviors and features.
Key benefits of using ML for IoA discovery include:
- Detection of previously unknown threat behaviors
- Identification of faint or partial attack indicators that may be missed
- Rapid analysis of huge volumes of data not easily processed manually
- Continuous improvement as models learn from new observations over time
As algorithms and computing power improve, ML has growing potential to automatically extract IoAs from massive security datasets to augment human threat hunters.
Challenges of IoAs vs IoCs
While IoAs and IoCs provide valuable threat intelligence, defenders should be aware of some inherent challenges:
- False positives – IoAs based on limited data may trigger alerts for benign activity, wasting resources.
- Evasion – Attackers adapt to avoid known IoAs/IoCs once discovered, requiring constant technique refresh.
- Complexity – Significant expertise and resources are required to effectively generate, manage and utilize threat indicators.
- Data overload – Sorting through huge volumes of indicators to identify meaningful signals is difficult.
- Maintenance – New indicators must be continually identified while old/invalid ones are pruned.
To address these issues, security teams should focus on high-fidelity IoAs with low false positives, and combine threat intelligence with adaptive analytics like machine learning to keep pace with evolving attacker behaviors.
Conclusion
Indicators of Attack and Indicators of Compromise provide critical threat intelligence to help defend against modern attacks. IoAs identify suspicious behaviors that may signal an emerging attack, while IoCs provide definitive forensic evidence of a successful breach. By leveraging both IoAs and IoCs, organizations can improve prevention, detection, response, and containment of security incidents.
Mature security programs implement processes to gather and utilize threat intelligence from both external and internal sources. By combining this knowledge of attacker TTPs and artefacts with real-time analytics, machine learning, and expert human judgement, defenders can turn the tide against adversaries and minimize business impact of attacks.