Daniel Roberson
  • Posts
  • About
  • Notes
  • Projects
  • Time
  • Posts
    About
    Notes
    Projects
    Time

Indicators of Compromise (IoC)

0001-01-01

An Indicator of Compromise (IoC) is a piece of digital forensics that suggests that a computer resource has been breached.

IoC monitoring is a reactive monitoring technique, meaning that if an IoC is observed, the compromise has almost certainly already occurred.


Links to this note

  • attribution-steffens2020
  • Main Index
  • sysrvbotnet-imperva2024
  • tricephalichellkeeper-pourcelot2022
  • anatomyofreallinuxintrusion-alonso2016
  • linenoise-phrack71-2024
  • trackingteamtnt-fiser2021
  • unpacking diicot-tikochinski2024
  • unveiling wolfsbane-sperka2024
  • skuld-taniumcti2023
  • chaos-lang2023
  • Main Index - I
  • Moonlight Maze samples
  • shell function as userland rootkit
  • Skidmap Indicators of Compromise (IoCs)

Recent Posts

Linux Persistence: Modular Software

2025-04-17 DFIR CTF persistence linux persistence apache asterisk

Linux Persistence: Web Shells

2025-04-16 DFIR persistence webshell linux persistence webshell apache nginx PHP

Linux Persistence: Rootkits

2025-04-15 DFIR persistence rootkit LKM linux persistence LKM rootkit LD_PRELOAD kprobe ftrace ld.so hooking

Linux Persistence: Processes

2025-04-11 DFIR persistence processes linux persistence processes

Defanging Linux LKM Rootkits With cleanup_module()

2025-04-05 Linux LKM rootkits EDR hooks incident response Linux LKM rootkit


Home

About

Notes

Projects

Time

© All rights reserved. Powered by Hugo and Erblog.