Technical Tracks
summary
Describes how indicators of compromise (IOCs) often start with low visibility and then follow a lifecycle of collection, analysis, and storage, backed by a cited 700% increase in security events and specific counts like 163 and 1,113 failed authentications. Presents 11 concrete use cases (brute force, database exfiltration, outbound C2, crypto‑mining, ransomware file changes, MITM, DDoS, etc.) and recommends that SOCs implement custom log parsing and correlation, SOAR playbooks, Active Directory auditing, and on‑prem ML; it promotes ManageEngine Log360 as an integrated log/IOC workflow solution.
AI-written summary · about
chapters (5)
- 0:00Introduction to theme
- 1:26What are IOCs
- 5:58IOCs versus IOAs
- 8:0411 use cases for IOCs
- 20:29Conclusion and tools
related talks
13mIOCs Are Dead -- Long Live IOCs!
30mTrawling for IOCs: Catching C2 in a Sea of Data
31mAttack Hunting with Threat Intelligence
30mThe SOC Counter ATT&CK
53mSecurity Operations 2018: What Is Working? What Is Not.
28mScaling Your Defenses: Next Level Security Automation for Enterprise
35mEnhancing Operations Through the Tracking of Interactive Linux-based Intrusion Campaigns
30mThe Hunt for Major League IoT-ICS Threats: A Deep Dive into IoT Threat Terrain