Malware › Module 8 › Lesson 1
IOC Types
Indicator types from $MAL_LAB analysis — hash, domain, IP, URI, file path, mutex, registry key as defensive artifacts.
Visual · t22_ioc_types
IOC types = defensive indicator categories. $MAL_LAB sourced. Original Cyberlium.
Opening
IOCs feed SIEM and EDR — learn the types and confidence tags, not how to spin fresh indicators for offense.
Indicators of Compromise (IOCs) are observable artifacts from analysis: cryptographic hashes (MD5/SHA1/SHA256), network (domain, IP, URL), host (file path, registry key, mutex, service name), email (address, subject pattern). Each IOC row needs type, value redacted appropriately, confidence (confirmed in $MAL_LAB / inferred / third-party), first-seen UTC, and linked sample hash. Cyberlium teaches IOC typing from YOUR lab timeline — NOT fabricating IOCs from stranger APT reports as your own, NOT publishing live samples with IOC bundles to Discord, NOT IOC lists targeting individuals. Defenders consume typed IOCs — attackers harvest careless shares.
1. Network IOCs
Domain, IP, URL, JA3/SNI metadata — redact if brief requires; note sink vs live internet.
Distinguish apex vs subdomain — blocking wrong level causes pain or misses.
Command guide
Try these commands — Network IOCs
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
IOC types — https://www.cisa.gov/stopransomware (hashes, domains, IPs) MalwareBazaar IOC export — https://bazaar.abuse.ch/export/ (defender feeds literacy)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install openssl
macOS: Built-in
Windows:
Command — copy this
choco install openssl
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t22-mal/lab.env" 2>/dev/null || export LAB_MAL=$HOME/cyberlium-lab/t22-mal sha256sum "$HOME/cyberlium-lab/t22-mal/samples/eicar.com.txt" | tee "$HOME/cyberlium-lab/t22-mal/notes/ioc-draft.txt" cat >> "$HOME/cyberlium-lab/t22-mal/notes/ioc-draft.txt" <<'EOF' type: sha256 (benign EICAR lab sample) strings: EICAR-STANDARD-ANTIVIRUS-TEST-FILE EOF
Command — copy this
grep -E 'sha256|EICAR' "$HOME/cyberlium-lab/t22-mal/notes/ioc-draft.txt"
Primary tools to practice this lesson: openssl, grep. Reference sites: IOC types (https://www.cisa.gov/stopransomware); MalwareBazaar IOC export (https://bazaar.abuse.ch/export/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Host IOCs
File path patterns under Temp/AppData, Run keys, mutex names from strings/dynamic — path templates with REDACTED user.
Hash IOCs strongest for file identity — prefer SHA256 for modern sharing.
3. Confidence and TTL
Tag confirmed $MAL_LAB observation vs intel paste; note expiration if domain sinkholed or DGA.
False positive awareness — generic strings are weak IOCs alone.
4. What you ship: IOC types reference card
Six IOC types + confidence tags + TTL note + hash-preference line.
5. What you record before the next lesson
IOC types reference path.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Publish roommate file paths as IOCs from guessed analysis.
Right
IOC types card from $MAL_LAB artifacts. Next: Report Structure.
Mission: IOC types reference
1) Define six IOC types. 2) Write confidence tag examples. 3) Hash vs domain priority rule. 4) TTL/expiry note.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Weak string IOC — when to exclude?”
Knowledge Check
APPLY: IOC types include:
Multiple choice
Knowledge Check
APPLY: True or False: Fabricate IOCs from stranger APT paste as yours.
True or False
Knowledge Check
APPLY: Strongest file IOC is often:
Multiple choice