Indicators and threat intelligence

Indicators of compromise, sharing them safely, and using real feeds like CISA KEV.

← Training·Level 4 of 9 · Kushmanda — the creator·Practitioner·about 8 minutes

1Indicators are evidence, not verdicts

An indicator of compromise (IOC) is an observable such as an IP address, domain, file hash or URL that has been linked to malicious activity. A match is a reason to look, not proof: an address can be reused, a domain can change hands.

Indicators age. A C2 address from last month may be someone's legitimate server today. Know when and where an indicator was reported.

2Share them safely

Defang indicators when sharing so nobody clicks them by accident: hxxp:// instead of http://, and example[.]com instead of example.com. Every indicator on this site is defanged for that reason.

3Prioritise with KEV

CISA's Known Exploited Vulnerabilities (KEV) catalogue lists vulnerabilities with evidence of exploitation in the wild. Severity scores say how bad a flaw could be; KEV says attackers are using it now. Patch KEV entries first.

Test what you learned

4 questions · pass mark 80% · every answer explains itself after you submit.

1.An IP on a threat feed appears in your logs. What does that mean?
2.Which is a correctly defanged URL?
3.What does CISA's KEV catalogue tell you?
4.Why do indicators expire?

Next level · SkandamataCredential attacks and account takeover

1Indicators are evidence, not verdicts

Indicators age. A C2 address from last month may be someone's legitimate server today. Know when and where an indicator was reported.

Test what you learned

4 questions · pass mark 80% · every answer explains itself after you submit.

1.An IP on a threat feed appears in your logs. What does that mean?
2.Which is a correctly defanged URL?
3.What does CISA's KEV catalogue tell you?
4.Why do indicators expire?