Indicators of Compromise
- •
def
- •
observable signs that a security incident is occurring or has occurred
- •
- •
examples
- •
- •
concurrent session usage — the same account appears to be logged in from multiple places at once
- •
blocked content — security tools stopping something they recognize as malicious
- •
impossible travel — a login from one location, then another geographically distant location, in a timeframe that's not physically possible
- •
resource consumption — unusual spikes in CPU, memory, or network usage
- •
out-of-cycle logging — log entries appearing outside normal patterns or schedules
- •
missing logs — an absence of expected log data, which can itself be a red flag (e.g., logs deliberately deleted to cover tracks)
- •
- •