What are the most common indicators of a threat actor?

It's easier to think of Indicators of Compromise (IOCs) into 4 types: 1) Network-based: These are determined by analyzing network traffic. Ex IOCs: - unusually high traffic connections - connections to known malicious IPs or domains - traffic over a non-standard network port 2) Host-Based: These are determined by analyzing system logs. Ex IOCs: - modifications to registry - changes to system config - attempts to access critical system files 3) File-Based: These indicate malicious files or malware. Ex IOCs: - presence of certain hashes, filenames, and file paths 4) Behavioral: These are based on unusual or anomalous behavioral signals. Ex IOCs: - impossible time travel - multiple failed logins followed by success

Beyond the usual spikes in bandwidth and suspicious IP addresses, it's essential to also monitor the patterns of data transfer. For instance, if a significant amount of data is being transferred late at night when office operations are minimal, it might indicate data exfiltration.

I think the most common indicators of a threat actor is : 1. Suspicious Network Traffic 2. Anomalous User Behavior 3. Detection of Malicious Software 4. Intrusion Detection/Prevention System Alerts 5. Unusual System Behavior 6. Phishing Attacks 7. Social Engineering Attempts

The majority of malicious network traffic I have seen are coming from known malicious IPs. I normally check the IP in VirusTotal, looking for references to other attacks or reports of the IP doing malicious things such as SSH Brute Forcing. I also will run it through an IP checker such as Scamalytics to see what organization the IP belongs to, the country of the IP, and if the IP belongs to a server, VPN, or TOR exit node. Another area to check is SecurityTrails where you can reverse lookup the IP to see if it is attached to a domain, as well as check how often the DNS information changes. For logins, I check for anomalies such as the user logging in through AT&T in Texas each day for work, but now someone is logging in from Comcast.

Here are some of the most common indicators of a threat actor: 1. Unusual Network Activity: Suspicious or unexpected network traffic patterns, such as a sudden increase in data transfers or communication with unfamiliar servers. 2. Unauthorized Access: Multiple failed login attempts, especially with incorrect usernames and passwords, may indicate an intruder trying to gain access through a brute-force attack. 3. Anomalous User Behavior: Unusual behavior by users, such as accessing sensitive data they shouldn't, could be a sign of an insider threat or a compromised account. 4. Malware Signatures: Detecting the presence of known malicious software or malware signatures on your systems or in email attachments.

This advise is misleading. Yes, the team should remove the suspicious file. But more importantly, how the malicious files reach the current locations and why it can penetrate the layer of defense. If your SOC only do removal and not closing the door, it can be defeated by overloading, which gave false sense of achievement for high successful defense number. Hiding actual data threft behind the scene.

Maintain Layered Defenses and Vigilance The cybersecurity landscape is diverse and ever-changing, with threat actors continuously refining their methods. While recognizing malicious files or processes is pivotal, it's equally important to maintain a multi-layered defense strategy. Incorporate firewalls, intrusion detection systems, and behavior-based analytics tools, to provide comprehensive coverageMoreover, ensure that all software and systems are patched and updated timely, as out-of-date systems often provide an easy gateway for intruders. Additionally, consider a regular audit of system logs and network traffic patterns to catch any anomalies. Prevention is essential, but early detection through vigilance can minimize potential damage.

Signature-based detection can be effective, but only if it's up to date! Updating your threat intelligence feeds ensures that your tools can recognize the latest malware variants. Consider leveraging heuristics and behavior-based detection mechanisms as well, as they can identify previously unknown threats by analyzing behavior patterns.

This is completely true, no organisation should have malware in their environment, however everything is subjective. What's not been addressed here is the timing of it. When did the organisation become aware of malware in their environment? For example, by removing malware that has been in the environment for long periods of time can cause significant impacts. Disrupting threat actors can trigger a response from them. It's never a simple, remove malware without thought.

Recognizing failed attempts, audited actions or auto remediated attacks is key. They're early warnings, reveal patterns, and offer valuable learning. What was the root cause, has the gap been closed or alert been set.

In my years of cybersecurity experience, I've found unusual user behaviour to be a critical indicator of potential threats. I've seen first hand how compromised accounts can wreak havoc. One incident that stands out involved an account suddenly accessing sensitive databases at 3 AM from an IP in a restricted geo-location and a deviation from their normal behaviour of business hours in Australia immediately raised red flags. To combat this, I always advocate for a multi-layered approach. Strong authentication policies are crucial, but they're just the start. I've implemented behaviour analytics tools that create baseline user profiles and alert on anomalies. Regular audits of access logs have also proven invaluable.

Compare the device against what the user normally uses. If they normally use an iPhone to login, and there is a login for Android, start there. Same device? Check the browser version. If they have been using Chrome 118 and then there is a login from a similar device but from Chrome 109, that would require a different device or for them to downgrade their Chrome which isn’t normal. Check the general location of the IP. If the user lives in Florida and logged in an hour ago, they are not going to login from California unless that IP is tied to a VPN provider. Check the actions performed. Was a new Inbox Forwarding rule created that moves emails to the RSS folder? Would a normal user do that? Would a hacker do that?

Good starting point but I would also add another layer of protection by integrating a solution that offers User and Entity Behaviour Analytics (UEBA). For example, with Microsoft Sentinel you can collect data from all sources connected to the SIEM, analyse them and build baseline behavioural profiles of your business such as users, hosts, IP addresses and apps. This solution not only will help you to identify security gaps and compromised assets but also the potential impact (blast radius).

Identifying unusual user behavior is a cornerstone in the detection and mitigation of threat actor intrusions within an environment. Such anomalies can be indicative of an external entity gaining unauthorized access or an internal actor with malicious intent. Key activities to watch for include the unexpected creation of new user accounts or the addition of members to privileged groups, which can signify an attacker's attempt to solidify their foothold and escalate privileges. These actions, typically outside the norm of daily operations, should raise immediate red flags.

Context Matters! An employee accessing files at odd hours might be suspicious, but what if they're working on a deadline or in a different time zone? Pairing behavioral analytics with contextual information can reduce false positives and give a clearer picture of potential insider threats.

While changes to the system or registry are common, certain critical paths and keys rarely change. Monitoring these can give early warnings. For example, changes to auto-run registry keys or modifications of system boot configurations can be strong indicators of system compromise.

ASR Rules are the best way to pickup these based on behaviour. ASR rules often involve behavioral monitoring of applications and systems. When suspicious registry or system changes occur, these rules can trigger alerts or responses based on predefined behavior patterns. For example, if an application attempts to make unauthorized changes to the Windows Registry, an ASR rule may flag this activity as suspicious and take action.

Every seasoned cybersecurity expert knows: persistent threat actors often leave the faintest footprints. Tweaking registry or system settings might seem like minute alterations, but they often form the base for more extensive incursions. It's similar to a thief replacing a lock for easier future access. Real-time monitoring and a keen eye for these changes can mean the difference between a secured system and a compromised kingdom.

Look for patterns! Repeated DNS requests to unknown or suspicious domains can be indicative of command and control (C2) communication. Similarly, a large volume of subdomain requests for a single domain might suggest a Domain Generation Algorithm (DGA) commonly used by malware.

DNS, the internet's address book, is also a favorite avenue for cyber-actors aiming to manipulate traffic or establish covert communication channels. Odd requests or deceptive responses can often act as smoke signals for something more malicious lurking beneath. Ensuring our DNS hygiene by utilizing cutting-edge verification tools and being wary of anomalies ensures we don't get led down the wrong digital alley.

Logs are the meticulous diaries of our systems, chronicling every event, large or small. But when these diaries are tampered with—missing entries or conflicting timestamps—it's as if pages have been torn out or rewritten. For a seasoned eye, such inconsistencies are bright neon signs of intrusion attempts. Therefore, secure log management paired with cross-referencing tools can shine a light on these dark tactics.

Having a SEIM that sits outside of the source system, with separate access boundary is key. Or at least protects any attempts post event. How often if ever are your logs audited? Do you collect all logs, or specific types. Do these relate to any threat analytics that may flag issues / inconsistence in real time. Overall a solid plan of what you are doing with the logs you chose to collect, can be a great starting point to get into the weeds, of: Access Control Immutable Logging Regular Log Backups Secure Timestamps Hashing and Digital Signatures Log File Encryption Separation of Duties Real-Time Monitoring Regular Auditing Education and Training Incident Response Plan Third-Party Validation

You would normally see visits from unknown IPs in your web, SIEM, firewall logs. Check the reputation and geo-location of these IPs and if not required, block them during the initial stages itself. A port scan seen in logs (SIEM /IDS) is a typical IOA. Additionally, look at user browsing and web visiting patterns. There could be some open connections from Endpoints to remote server. Trace such suspicious traffic. Look for file integrity changes, unauthorized apps, registry or system file changes, background processes on endpoints as they could also serve as IOC

Sharing two thoughts: 1. Automation (e.g., SOAR, UEBA) in conjunction with knowledgeable & well-coordinated cyber defenders is key. 2. Sophisticated threat actors often use "false flags" by mimicking the TTPs of other groups to confuse defenders/investigators & complicate attribution efforts

Of course, can't deny there can be a lot more, but attackers possibly will need to launch the following attacks at some point in time, making them more prominent events to hunt for in Windows-dominant environments. -Use of legit programs for DLL sideloading -Legit binaries connecting to non-standard external IPs -Launch Active Directory Recon activities -Pass-the-ticket, Kerberos attacks -Use credentials of privileged users and access systems -Dump the LSASS process -Hit the shared folders and search for credentials -Use of WMI/SMB services for RCE -Launch DCSync and worst-case NTDS dumps -Drop well-known attack binaries in systems -Spawning processes to launch all above activities This becomes more prominent if done post-business hours!

As a cyber security consultant, I've seen many different Indicators of Compromise/Attack. To understand what the IOC/IOA is, just bring it back to the basic understanding, "What is the suspected device doing, and why is it doing it?" This can mean that even an unscheduled patching cycle could be an indicator of compromise.