Indicators of Compromise - CompTIA Security+ SY0-701 - 2.4

Summary

This video script highlights key Indicators of Compromise (IOCs) that IT security professionals use to detect potential system breaches. It covers various signs like unusual network traffic, account lockouts, simultaneous logins from distant locations, and unauthorized file access. The script also discusses how attackers disable security updates and manipulate logs to stay undetected. Additionally, it emphasizes the importance of monitoring login patterns, abnormal resource consumption, and data exfiltration. By identifying these IOCs, security professionals can better protect their systems from ongoing or future attacks, ensuring swift action against threats.

Takeaways

• 😀 Account lockouts due to incorrect password attempts, especially when not made by the legitimate user, may indicate unauthorized access attempts or malicious activity.
• 😀 Unusual login locations, such as logins from far-apart geographical areas in a short period, are clear indicators of compromise and require immediate investigation.
• 😀 Disabling security updates or antivirus software can be a sign that an attacker is trying to maintain access and prevent security patches from being applied.
• 😀 A sudden spike in network traffic, especially at unusual hours, could indicate data exfiltration or other malicious activity occurring on the network.
• 😀 Inaccessible resources like servers or file systems may point to a disruption caused by an attacker exploiting vulnerabilities in the system.
• 😀 Out-of-cycle logging, such as security patches or application installs happening at unexpected times, can be a red flag indicating unauthorized changes or tampering.
• 😀 Deleting logs to hide traces of activity is a common tactic used by attackers to cover their tracks. Missing logs should trigger alerts to investigate possible breaches.
• 😀 Exfiltrated data appearing publicly on the internet can indicate that sensitive information has been stolen, possibly in conjunction with a ransomware attack.
• 😀 When analyzing login activity, consider impossible logins (e.g., simultaneous logins from distant locations), which are often signs of account compromise.
• 😀 Resource consumption monitoring, such as unusual file transfers or network usage patterns, is crucial for detecting potential breaches early and identifying the actions of attackers.

Q & A

What is an Indicator of Compromise (IOC)?

An Indicator of Compromise (IOC) is evidence that suggests a security breach or unauthorized access to a system. It could include unusual network traffic, modified files, or abnormal login patterns, among other signs.

How can unusually large network traffic be an indicator of compromise?

Unusually large network traffic can indicate that data is being exfiltrated from your systems or that malicious activity is taking place, such as the transfer of files or information that is not typically seen during normal operations.

What could a change in hash values of stored files indicate?

A change in the hash values of files could indicate that those files have been modified, possibly by an attacker, to introduce malware or other harmful alterations.

Why would an account lockout be an indicator of compromise?

An account lockout, especially due to multiple failed login attempts, could indicate an attacker trying to brute force their way into an account. If the account is locked without the user’s knowledge or consent, it might also suggest that someone is trying to prevent the user from accessing their account for malicious reasons.

What does it mean when a login occurs from multiple locations at the same time?

If a login occurs from multiple locations in a very short timeframe, it could indicate a compromised account. Traditional physics tells us it’s impossible for someone to be in two places at once, so this could be a sign of unauthorized access or an attacker hijacking the account.

How does malware disable antivirus software updates?

Malware can disable antivirus software updates to prevent the user from receiving critical security patches. This ensures that the attacker can maintain access to the system for longer periods without being detected or removed by updated antivirus signatures.

What should you do if you notice impossible logins from distant locations?

If you notice logins from distant locations occurring within a short period, you should investigate further. This could indicate that someone has hijacked a user's account. Authentication logs should be reviewed to confirm if the logins are legitimate or if they suggest a compromise.

How can resource consumption patterns indicate a compromise?

An increase in resource consumption, such as higher network traffic or excessive file transfers, could signal that an attacker is actively moving data across systems or out of the network. This abnormal activity is often a key indicator of a breach.

What is the significance of out-of-cycle logging in security monitoring?

Out-of-cycle logging refers to logs of activities that occur outside of the normal scheduled times for security patches or updates. This could be a sign that an attacker is attempting to install malicious software or alter system configurations when they shouldn't be.

How can attackers manipulate log files to hide their presence?

Attackers may delete or tamper with log files to erase traces of their activities on compromised systems. Monitoring for missing log information or anomalies in log data can be crucial for detecting such attacks.