Evaluating Indicators as Composite Objects
summary
Joe Slowik examines indicators/IOCs as composite objects rather than isolated atomic items, arguing that treating them as structured combinations can improve analysis and detection. The talk focuses on reframing indicator design and use within Cyber Threat Intelligence to enable more robust detection mechanisms.
AI-written summary · about
chapters (20)
- 0:00Intro
- 0:21Disclaimer
- 1:58Agenda
- 3:27Indicators Of Compromise
- 7:08Indicators In Practice
- 9:19Debasement Of The IOC
- 10:08Indicators As Atomic Objects
- 11:58Splitting The Atom
- 12:26Indicators As Natural Composites
- 12:53Identifying Subcomponents
- 13:38Example: Network Objects
- 18:46Example: PE Files
- 22:38Example: Office Documents
- 25:43Composite Characteristics
- 26:44Behavioral Identification & Pivoting
- 29:10Indicator Classification
- 30:21Examples
- 33:48Potential Pitfalls
- 37:23Implementing In Your Environment!
- 39:19References & Resources
related talks
13mIOCs Are Dead -- Long Live IOCs!
28mBillions of Indicators, Zero Action: How We Fixed That
22mTechnical Tracks
26mIC5 – Integrated CERT Cyber Communications, Collaboration & Coordination Framework
37mAutomatic Extraction of Indicators of Compromise for Web App.
41m"Meet Me in the Middle: Threat Indications & Warning to enable..."
41mOne SOC, The Whole SOC, and Nothing But The SOC, So Help Me
55mDefender Perspectives: Getting ROI from Cyber Threat Intelligence Vendors