Threat › Module 3 › Lesson 1
IOC Named
IOC named literacy covers hashes, IPs, domains, URLs, emails, and file paths — practice with fictional lab indicators on YOUR $TI_LAB only.
Visual · t33_ioc_named
IOC literacy. $TI_LAB only. Original Cyberlium.
Opening
Indicators are artifacts — literacy names IOC types so you enrich and block on lab samples you authored, not live victim dumps from criminal forums.
Indicators of Compromise (IOCs) are observable artifacts tied to malicious activity — file hashes (MD5, SHA-256), IP addresses, domains, URLs, email addresses, registry keys, and mutex names. IOCs are brittle — attackers rotate them quickly — but they enable immediate detection and blocking when fresh. Literacy names types and confidence before SIEM ingestion. Cyberlium practices IOC naming on YOUR $TI_LAB — inventory fictional hashes, domains, and IPs with lab labels. Next: TTP Named.
1. IOC types (named)
Hash: MD5, SHA-1, SHA-256 of malware sample — LAB-SHA256-CYBERLIUM-001 style labels. Network: IP (203.0.113.45), domain (evil-lab.example.local), URL path. Email: phish sender address on fictional domains. Host: registry key, mutex, file path on labeled lab systems.
On $TI_LAB, write IOC inventory — one example per type with fictional lab label and confidence note.
Command guide
Try these commands — IOC types (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
STIX indicators — https://oasis-open.github.io/cti-documentation/stix/intro.html MISP IOC types — https://www.misp-project.org/objects.html CISA IOC guidance — https://www.cisa.gov/topics/cyber-threats-and-advisories
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export TI_LAB=${TI_LAB:-$HOME/cyberlium-lab/t33-ti}
cat > "$TI_LAB/notes/ioc-types-named.txt" <<'EOF'
IOC types — NAMED LITERACY (YOUR fake values only):
Network: ipv4-addr (192.168.0.0/16 RFC1918 lab), domain-name (example.com)
File: sha256 hash (EICAR test file label — not live malware)
Email: email-addr ([email protected])
URL: url (https://example.com/phish-lab-page)
Registry/host artifacts: document in notes — no real victim hostnames
Defenses: TTL on IOCs, confidence scoring, ATT&CK context over raw lists
EOFCommand — copy this
grep -E 'ipv4-addr|example.com|EICAR|confidence' "$TI_LAB/notes/ioc-types-named.txt"
Primary tools to practice this lesson: grep, python3. Reference sites: STIX indicators (https://oasis-open.github.io/cti-documentation/stix/intro.html); MISP IOC types (https://www.misp-project.org/objects.html); CISA IOC guidance (https://www.cisa.gov/topics/cyber-threats-and-advisories). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why IOC literacy precedes feed ingestion
Blind blocklist imports cause false positives and alert fatigue. Analysts who cannot name IOC types mis-triage enrichment results. Confidence scoring and expiration dates reduce stale indicator noise.
Students inventory lab IOCs on personal notes — never import live victim dumps from criminal marketplaces without authorization.
3. Lab boundary
Forbidden: pasting live ransomware C2 lists from breach dumps. Allowed: IOC named card — six types with $TI_LAB fictional examples and confidence field.
Ship: IOC named card for YOUR lab inventory. Next: TTP Named.
4. What you ship: IOC named card for $TI_LAB
Six IOC types with fictional lab examples and confidence. $TI_LAB named. chmod 600.
5. What you record before the next lesson
Date. IOC named card. $TI_LAB named. File t33-m03-l01-ioc-named.txt chmod 600.
6. Wrong vs right: criminal markets vs YOUR lab IOCs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Import live breach hash dump without labeling. Block RFC5737 lab IP in production SIEM without review.
Right
Write IOC named card for YOUR $TI_LAB inventory. Next: TTP Named.
Mission: inventory IOC types on YOUR lab
1) List six IOC types with one fictional example each. 2) Add confidence and expiration note per IOC. 3) Confirm all indicators are lab-authored. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
IOCs expire fast — label confidence and collection date on every lab indicator.
Knowledge Check
APPLY: SHA-256 hash in TI context is:
Multiple choice
Knowledge Check
APPLY: True or False: IOCs are brittle and attackers rotate them frequently.
True or False
Knowledge Check
APPLY: IOC named literacy on Cyberlium avoids:
Multiple choice