Cyberstudy
PDF p.342 In progress

TTPs and IoCs

Open PDF at p.342 18 flashcards

Summary

PDF p.342

Tactics, Techniques, and Procedures (TTPs) describe the behaviors and methods used by threat actors. Indicators of Compromise (IoCs) are signs that an asset or network has been attacked. Modern threat detection relies on understanding TTPs and identifying IoCs.

Detailed explanation

PDF p.342
  • Antivirus (A-V) Scanners
    • Signature-Based Detection: Recognizes known malware code stored as signatures in a database.
    • Limitations: Effective for commodity malware but not for advanced threats.
  • Tactics, Techniques, and Procedures (TTPs)
    • Tactic: High-level description of threat behavior (e.g., reconnaissance, persistence).
    • Technique: Intermediate-level description of how a tactic is executed (e.g., network scanning).
    • Procedure: Detailed description of how a technique is performed (e.g., specific tools used).
  • Example of TTP Analysis
    • Scenario: Criminal gang using ransomware to blackmail companies.
    • Tactics: Reconnaissance, resource development, initial access, execution.
    • Techniques: Exploiting vulnerabilities in network monitoring software.
    • Procedures: Installing compromised software through infected repositories.
  • Indicators of Compromise (IoCs)
    • Definition: Residual signs of a successful or ongoing attack.
    • Examples: Compromised process versions, C&C network connections, disabled recovery features, encrypted files, blackmail notices.
  • Modern Threat Detection
    • Integration: Uses threat feeds of published TTPs and IoCs.
    • Automation: AI systems perform automated analysis to detect malicious behaviors.
  • IoCs vs. IoAs
    • IoC: Evidence of a successful attack.
    • IoA: Evidence of an intrusion attempt in progress.

Important terms

taken from the text above
Signature-Based Detection
Recognizes known malware code stored as signatures in a database.
Tactic
High-level description of threat behavior (e.g., reconnaissance, persistence).
Procedure
Detailed description of how a technique is performed (e.g., specific tools used).
Tactics
Reconnaissance, resource development, initial access, execution.
Procedures
Installing compromised software through infected repositories.
Indicators of Compromise (IoCs)
Residual signs of a successful or ongoing attack.
Automation
AI systems perform automated analysis to detect malicious behaviors.
IoC
Evidence of a successful attack.
IoA
Evidence of an intrusion attempt in progress.
IoCs Indicators of Compromise A-V Antivirus

What I should remember

Key Points PDF p.342
  • Antivirus Scanners
    • Signature-Based: Recognizes known malware.
    • Limitations: Not effective for advanced threats.
  • TTPs
    • Tactic: High-level threat behavior.
    • Technique: How a tactic is executed.
    • Procedure: Detailed execution method.
  • IoCs
    • Definition: Signs of an attack.
    • Examples: Compromised processes, C&C connections, encrypted files.
  • Modern Detection
    • Integration: Uses threat feeds.
    • Automation: AI for analysis.
  • IoCs vs. IoAs
    • IoC: Successful attack evidence.
    • IoA: Intrusion attempt evidence.