IOC Candidates
IOC candidates from hashes and strings — document, validate on $MAL_LAB, share safely per policy.
Visual · mal_ioc_candidates
IOC candidate literacy. $MAL_LAB only. Original Cyberlium.
An IOC candidate becomes an IOC only after validation and policy-approved sharing.
Indicators of Compromise (IOCs) include file hashes, domains, IPs, URLs, mutexes, and registry paths. Analysts extract candidates from static strings and dynamic sandbox reports, validate false positives, and publish via STIX/TAXII or internal ticket — never live malware zips. Cyberlium teaches IOC candidate hygiene for $MAL_LAB reports. You will NOT publish untested strings as blocklist entries or share org data without authorization. Next: Strings Lab.
1. Candidate vs confirmed IOC
Candidate: string looks like domain — unconfirmed. Confirmed: $MAL_LAB dynamic shows DNS query + egress, or multi-source intel agrees. Document confidence: low/medium/high.
Blocking high-confidence sha256 on EDR is common; blocking ambiguous strings causes false positive pain.
Command guide
Try these commands — Candidate vs confirmed IOC
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
strings(1) — https://man7.org/linux/man-pages/man1/strings.1.html (extract printable text) YARA string ideas — https://yara.readthedocs.io/en/stable/writingrules.html
═══ INSTALL ═══
Linux (Debian/Ubuntu): Built-in (binutils)
macOS: Built-in
Windows: Use WSL or install binutils
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t22-mal/lab.env" 2>/dev/null || export LAB_MAL=$HOME/cyberlium-lab/t22-mal strings "$HOME/cyberlium-lab/t22-mal/samples/eicar.com.txt" strings "$HOME/cyberlium-lab/t22-mal/samples/demo_toy.py" | head -8
Primary tools to practice this lesson: strings. Reference sites: strings(1) (https://man7.org/linux/man-pages/man1/strings.1.html); YARA string ideas (https://yara.readthedocs.io/en/stable/writingrules.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. IOC table structure
Columns: type (hash/domain/ip/mutex), value, source (strings/static/dynamic), confidence, validation note. sha256 always row one for file samples.
Cross-reference M4 hash log and strings grep output into one table per sample.
3. Share safely
Share hashes and confirmed IOCs per org/class policy — not live samples, not victim PII, not unauthorized production telemetry. MalwareBazaar uses tags and hashes — follow their rules.
Ship: IOC candidate table template with confidence column. Next: Strings Lab.
4. What you ship: IOC candidate table template
Columns: type, value, source, confidence, validation. Safe sharing rules. $MAL_LAB dynamic validates. chmod 600.
5. What you record before the next lesson
Date. IOC table template. $MAL_LAB named. File t22-m04-l03-ioc-candidates.txt chmod 600.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Block every strings URL globally without validation. Post live sample + victim logs in chat.
- Right: Write IOC candidate table template. Next: Strings Lab.
Mission: template IOC candidate table
1) Define table columns including confidence. 2) Write candidate vs confirmed definitions. 3) Add safe sharing rule. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Confidence labels prevent SOC false-positive storms.
APPLY: IOC candidate on Cyberlium means:
APPLY: True or False: sha256 is typically the primary file IOC in reports.
APPLY: Sharing analysis output should avoid: