The document discusses recommendations for implementing IOCs (indicators of compromise) to improve security investigations and incident response. It recommends using the Collective Intelligence Framework (CIF) to manage IOC feeds from multiple sources, generate actionable IOCs, and implement DNS sinkholing to redirect suspicious traffic. It also provides an overview of tools like IOC Editor, IOC Finder, Redline, and GRR that can be used to develop, analyze, and search for IOCs during investigations.

1. IOCs for Modern Threat Landscape
IOCs for IR
An Overview and Recommendations
Sai Kesavamatham

2. Overview
• IOC and Samples
• IOC Life Cycle
• Current Process
• Tools
• Implementation Recommendations

3. References:
The Open IOC Framework
Collective Intelligence Framework (Google Code)
GRR (Google Rapid Response)

4. IOCs
• IOCs – Indicators Of Compromise are forensic artifacts left behind
by an intrusion that can be identified on a host or network
• Artifacts left in Physical Memory, File System, Registry, Running processes
• Bad MD5 hashes, File Names, Registry settings, URLs, IP addresses etc.
• Usually developed using Static or Dynamic Analysis
• Sources
• External feeds – free, commercial, Govt. agencies
• Developed from internal IR incidents - e.g. malware analysis, packet captures etc.

5. Sample IOCs
Host URI: sp-storage.spccinta.com
Network Activity: User-Agent: Mozilla/4.0 (compatible; )
Sighted: 2014-07-09
Killchain Phase: Exploitation
Characterization: Domain Watchlist
Notes: Stage 1 Malicious Domain
GET statement: AutoUpdate.zip
Malicious Domain observed usually occurring in a pairing with Stage 2 Domain & POST
_____________________________________
Host IPv4: 184.28.64.243
Sighted: 2014-07-09
Killchain Phase: Command and Control
Characterization: C2
Notes: Comcast Cable Comm - Cambridge, MA

6. IOCs in the Investigative Life Cycle

7. IOCs and the need to manage
• Lack of or incomplete and inefficient use and maintenance of IOCs
• Not using IOCs effectively across available security stack layers
• Anti-Virus
• DNS
• Firewalls
• IDP
• Lists do not provide context
 Who did the list come from?
 An MD5 of what?
 Where is the history and past reports?
 How can I maintain?
 How do I report and share?

8. Some Tools and Sources in the market
• IOC Feeds
 Getting from external agencies and commercial subscriptions
 Free feeds e.g. CIF – Collective Intelligence Framework (Open Source)
• IOC - Recording, Managing and Sharing Information
 OpenIOC standard - Released by Mandiant
 IOC Editor and IOC Finder (Free) – Released by Mandiant
 GRR - Google Rapid Response (Open Source)
• Live Forensics and Malware Analysis
 GRR - Google Rapid Response (Open Source, supports many platforms)
 RedLine – Free from Mandiant for individual Windows hosts
 Encase – Are we using it for other than legal investigations?

9. Implementation
Recommendations

10. CIF – Collective Intelligence Framework
CIF – Cyber Threat
Intelligence Management
System
• Allows to combine known malicious
threat information from many
sources (Reputation Feeds)
• Creates actionable IOCs to feed
into
 Detection – IDP signatures,
DNS Sinkholing
 Mitigation – Null Route
 Identification – Incident
Response
• IOCs are generated dynamically
every hour
 Can be generated with
different confidence levels on
a scale of 1 to 10

11. Typical DNS query flow – CIF Use Case
CLIENT
1. Email with a Target URL link (Could be phishing)
DNS Server
2. Client asks for IP address of Target URL link
3. DNS Server responds with IP Address
4. Client contacts the Target
TARGET

12. DNS query flow with Sinkhole in place
CLIENT
DNS Server
BAD GUY
1. Phishing Email with a Target URL link
2. Client asks for IP address of Target URL link
3. DNS Server responds with Fake IP Address
4. Client contacts the Target (DSN Sinkhole) DNS
Sinkhole
Dynamic IP
Reputation
Feeds
(Replace Bad Guy with DNS Sinkhole IP Address)
Log client queries
Send to SIEM
Follow up with IR

13. CIF – DNSSinkhole in production (Example)
• Client query to DNS on 19-Sep-2014 16:56:24
Who is: www.000007.ru (Bad Guy as per CIF)
• DNS response to client
www.000007.ru is 192.168.3.4
• In the above example, 192.168.3.4 is the address of the
DNSSinkhole
• Client connections end up in sinkhole
Legend
RED – URLs with bad reputation
BLUE – DNS sinkhole

14. CIF – Query and Submission
Browser Plugins for CIF
Query and Data Submission
• Standard Browser plugins are
available
 Query individual IOCs
 Submit new IOCs

15. Next Steps - DNS Sinkhole reports
• Aggressive Response
 Find the clients that are trying to contact the bad URLs
Proactively analyze DNS query logs and clean up the machines
Improve CIF database with internal IOCs
Needs resources with hands-on experience
• Passive Response
 Continue with the current CIF setup in Production
End user machines continue to fail to contact bad guys
No difference to end user experience
Use the data in reactive mode for future investigations

16. IOC Editor - Maintaining IOCs in OpenIOC format
IOC Editor
 Creates IOCs in OpenIOC
format
 Easy to use UI
 Ability to add each entity
from provided IOCs
 Add IOC entities as OR or
AND conditions
 Creates s simple XL
format that can be used to
convert to other IOC
formats like STIX

17. IOC Finder
IOC Finder
 Command line utility used
in host level analysis
 Tow-phased workflow
 Collect data suitable
for general IOC
matching
 Analyze the collected
data looking for and
reporting IOC hits
 Can be used to collect data
from multiple hosts to a
common network location
 Run analysis to find IOC
hits

18. RedLine – Single Host Malware Analysis
Host Investigation
Redline from Mandiant
(Free) and can be used for
individual hosts
Memory, File System,
Running processes, Registry
Perform IOC analysis if
supplied with a list of IOCs
Provided Redline Malware
Risk Index to find high value
processes
Only for Windows

19. GRR – Google Rapid Response (Centralized)
GRR - Google Rapid
Response (Open Source,
supports many platforms)
Central console for
multiple hosts
Advanced Malware
Analysis features
Can run scheduled hunts
for IOCs across multiple
systems
Can do Registry, File
System, Memory, Process
Anaylsys