Python Forensics – Indicators of Compromise

Indicators of Compromise (IOCs) are defined as “pieces of forensic data, including data found in system log entries or files, that can identify potentially malicious activity on a system or network.”

By monitoring IOCs, organizations can detect attacks and take swift action to prevent such damage from occurring, or limit the damage by stopping the attack in its early stages.

There are several use cases that allow for querying forensic artifacts, such as

• Finding a specific file by MD5
• Searching for a specific entity physically stored in memory
• A specific entry or set of entries stored in the Windows Registry

A combination of all of the above provides better results when searching for artifacts. As mentioned above, the Windows Registry provides a perfect platform for generating and maintaining IOCs, which directly aids in computational forensics.

Methodology

• Look for locations in the file system, specifically those now accessing the Windows Registry.

• Look for artifact sets designed by forensic tools.

• Look for any signs of adverse activity.

Investigation Lifecycle

The investigation lifecycle follows IOCs, which search for specific entries in the registry.

• Phase 1: Initial Evidence – Evidence of an intrusion is detected on a host or network. Responders will investigate and determine the exact solution, which is a specific forensic indicator.

• Phase 2: Create IOCs for Hosts and Networks – After collecting data, create IOCs, which is easily accomplished through the Windows Registry. The flexibility of OpenIOCs provides an infinite number of permutations for creating indicators.

• Phase 3: Deploy IOCs Across the Enterprise – Once the designated IOCs are created, investigators deploy these techniques with the help of the Windows Registry API.

• Phase 4: Identify Suspects – Deployment of IOCs helps identify suspects in the normal way. Even other systems will be identified.

• Phase 5. Collect and Analyze Evidence – Evidence against the suspect is collected and analyzed accordingly.

• Phase 6. Refine and Create New IOCs – Based on their evidence, data discovered across the enterprise, and additional intelligence, the investigation team can create new IOCs and continue the refinement cycle.