Hidden Warnings: A Look at Indicators of Compromise (IoC)

The check engine light tells you when one of your car’s systems has failed. Your cellphone alerts you when the battery is low. Your home security system sounds an alarm if it detects an intruder. Your home computer displays a warning message when a device or piece of software malfunctions. From a design perspective, it seems simple: You understand what to look for and you design a monitoring control around it. But what if your task is to reliably detect intrusions within a network or operating system? What if you’re building a system to identify indicators of compromise (IoC)? That is not simple at all.

There’s Salt in My Coffee! Now What?

On the surface, you know something isn’t right. Complaints that customers are receiving virus notifications when viewing your company’s website have begun without warning. Some of your sensitive data has been leaked on Twitter accounts and made fully available to the public on Pastebin. Your executive staff receives strange emails that appear to be from your company’s CEO and are sent from the internal mail system requesting that a large amount of money be transferred to an account that is already 30 days late for payment. All these things should raise a red flag. Scenes like these are taking place daily on a wide array of enterprise networks. And they’re causing millions of dollars in damage to companies and governments worldwide, perpetrated by an even wider array of attacker groups, company insiders, state-sponsored consortia and cybercriminal organizations.

Reading Between the Lines: Building a Better Rat Trap With IoC

Let’s say you’re fairly sure that your network may have been compromised. What do you do? There’s a good chance your first response would be to panic. Yet over the last few years, analytic techniques and tools have been developed and made available to the public — some for free, and others for a price. Either way, they can assist with digging in and identifying an IoC on your network, allowing you to build detection capabilities to find the root cause of a specific attack type and prevent breaches from recurring.

Interested in emerging security threats? Read the latest IBM X-Force Research

Dave McMillen

Senior Threat Researcher, IBM X-Force

Hive0051’s large scale malicious operations enabled by synchronized multi-channel DNS fluxing

12 min read - For the last year and a half, IBM X-Force has actively monitored the evolution of Hive0051’s malware capabilities. This Russian threat actor has accelerated its development efforts to support expanding operations since the onset of the Ukraine conflict. Recent analysis identified three key changes to capabilities: an improved multi-channel approach to DNS fluxing, obfuscated multi-stage scripts, and the use of fileless PowerShell variants of the Gamma malware. As of October 2023, IBM X-Force has also observed a significant increase in…

Email campaigns leverage updated DBatLoader to deliver RATs, stealers

11 min read - IBM X-Force has identified new capabilities in DBatLoader malware samples delivered in recent email campaigns, signaling a heightened risk of infection from commodity malware families associated with DBatLoader activity. X-Force has observed nearly two dozen email campaigns since late June leveraging the updated DBatLoader loader to deliver payloads such as Remcos, Warzone, Formbook, and AgentTesla. DBatLoader malware has been used since 2020 by cybercriminals to install commodity malware remote access Trojans (RATs) and infostealers, primarily via malicious spam (malspam). DBatLoader…

New Hive0117 phishing campaign imitates conscription summons to deliver DarkWatchman malware

8 min read - IBM X-Force uncovered a new phishing campaign likely conducted by Hive0117 delivering the fileless malware DarkWatchman, directed at individuals associated with major energy, finance, transport, and software security industries based in Russia, Kazakhstan, Latvia, and Estonia. DarkWatchman malware is capable of keylogging, collecting system information, and deploying secondary payloads. Imitating official correspondence from the Russian government in phishing emails aligns with previous Hive0117 campaigns delivering DarkWatchman malware, and shows a possible significant effort to induce a sense of urgency as…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

There’s Salt in My Coffee! Now What?

Reading Between the Lines: Building a Better Rat Trap With IoC

More from Intelligence & Analytics

Hive0051’s large scale malicious operations enabled by synchronized multi-channel DNS fluxing

Email campaigns leverage updated DBatLoader to deliver RATs, stealers

New Hive0117 phishing campaign imitates conscription summons to deliver DarkWatchman malware

Topic updates