indicators of compromise

indicators of compormise (ioc)

event that indivcatrs an intrusion

indicators

unusual amoutn of network activity

change to file hash values

irregular international traffic

changes to dns data

uncommon login patterns

spikes of read requests to certain fiels

acoutn lockout

credentials are not working even thou you didnt get your accoutn locked

could an admimn disable your account

yes

concurrent session usage

multiple account logins from multiple locations

blocked content

attacker wants to stay as long aas possible so user cant do any ser=curity patches, anti-malware sites, romes tools

impossible travel

authencitation logs are from different parts of the owlrd

resource consumption

when an atacker has access to systems, soemthing is always there that allows you track their progress

resource inaccsssibility

servver is down and not responding

network disruption

server outage

encrypted data

brute force attack

out of cycle logging

occurs at aan unexpected time

operating system patch logs show abnnormal times

firewall log activity

missing logs

log information is evidence

attackers will try to cover their tracks be removing logs

authentication logs, file access logs, firewall logs, proxy logs, server logs

published/documented

data is published on teh internet

sometimess done in conjunction with ransomware