침해 지표(IoC)

침해 지표란 무엇인가요?

파일 기반 IoC: 해시

# Compute SHA-256 hash of a suspected malicious file
sha256sum suspicious_file.exe
# Output: 4a5678bc...  suspicious_file.exe

# Search for this hash in threat intelligence platforms
# curl 'https://www.virustotal.com/api/v3/files/4a5678bc...' -H 'x-apikey: KEY'

# Windows equivalent
Get-FileHash suspicious_file.exe -Algorithm SHA256

네트워크 기반 IoC: IP 주소 및 도메인

# Check if a domain is listed as malicious (using DNS blacklist)
dig +short 198.51.100.1.zen.spamhaus.org
# A response means the IP is listed as malicious

# Block a malicious domain at DNS level (Linux /etc/hosts sinkhole)
echo '0.0.0.0 malware-c2.evil.com' >> /etc/hosts

# Query firewall logs for known bad IP
grep '203.0.113.45' /var/log/firewall.log

URL 및 URI 지표

레지스트리 및 파일 시스템 IoC (Windows)

# Check common persistence locations on Windows
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run

# List scheduled tasks (look for unusual entries)
schtasks /query /fo LIST /v | findstr /i 'task name status'

# Check startup folder contents
dir '%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup'

행동 기반 IoC: 비정상 패턴

IoC의 고통의 피라미드

SIEM 규칙으로 IoC 탐지

# Example Splunk SPL rule for impossible travel IoC
# Detect same user logging in from two countries within 1 hour
index=auth_logs sourcetype=ldap action=login
| sort 0 user, _time
| streamstats current=f last(src_country) as prev_country last(_time) as prev_time by user
| where src_country != prev_country AND (_time - prev_time) < 3600
| table user, src_country, prev_country, _time

IoC 수명 주기: 최신성이 중요합니다

IoC를 위한 이메일 헤더 분석

# Extract IoCs from an email file (.eml) using Python
import email
with open('suspicious.eml', 'r') as f:
    msg = email.message_from_file(f)

# Extract sender information
print('From:', msg['From'])
print('Return-Path:', msg['Return-Path'])
print('Received:', msg.get_all('Received'))
# Then extract and analyze any URLs in the body

IoC와 공격 지표(IoA) 비교

빠른 확인

강의 요약