As many of you already know from my previous articles, I have always been a strong supporter of Indicators of Attack (IoAs) over Indicators of Compromise (IoCs). IoCs are useful, and I use them almost every day for investigations, Threat Hunting, and building my own Threat Intelligence feeds. But I believe we can get much more value from them than simply collecting indicators such as IP addresses, domains, or hashes.
Every week, we see cybersecurity articles describing new campaigns, malware, or variations of attacks we already know. Sometimes the only difference is a new payload, a different domain, or a small change in the execution chain. Interesting research, of course, but what additional value can we extract if our detections already cover the attack behaviour?
Let’s take this recent CyberSecurityNews article about ClickFix as an example. It describes malicious activity involving ClickFix and provides several IP addresses, domains, and other indicators. Great! We can import them into MISP, OpenCTI, Defender XDR, or Sentinel, investigate historical connections, and potentially block the malicious destinations.
https://cybersecuritynews.com/hackers-use-clickfix/But what happens tomorrow when the attacker creates another domain? Will the researchers update the article? Publish another one? Will someone add the new IoCs to a public feed? Everything is possible, but personally, I don’t think I will have the time or even remember to revisit the article. I will probably be busy with another incident or some other security investigation.
So why don’t we try to find something more interesting behind those IoCs?
Hunting IOC patterns
Instead of investigating every indicator individually, let’s look at what they have in common. What happens if we enrich those IPs using WHOIS, BGP, and ASN information?
See content credentials
We have now a pattern (one among others) and we have a clear picture of an abused ASN infrastructure.
Of course, sharing an ASN doesn’t automatically make an IP malicious. Large hosting providers can have thousands of legitimate customers but the reputation of the ASN + more than 1 month average to take a malicious domain down…is quite a big signal. In addition, what if we combine that information with other data?
Imagine a user receiving an email containing a URL, clicking it, and connecting to a previously unseen domain hosted on that ASN and to an unexpected country ( such as Estonia in the image above), suddenly we have a much more interesting hunting scenario.
We are no longer looking exclusively for a known malicious IP. We are investigating a combination of infrastructure and behaviour.
And here comes my favourite part. Tomorrow, the attacker creates a new domain that nobody has reported yet. However, they reuse infrastructure belonging to the same ASN we have been investigating. If we have already developed hunting logic around that infrastructure and its associated behaviour, we may identify suspicious activity without waiting for someone to publish the new IoC. Imagine a new Rule such as [DR] — New Email with an URL Linked to known abused ASN (62005).
From IoCs to hunting opportunities
I already explored this approach in my previous article, Threat Hunting via Autonomous System Numbers (ASN), where I discussed using network infrastructure information to identify suspicious activities beyond individual IP addresses.
The same concept can be applied to published Threat Intelligence where we can use known tools such as MISP and/or OpenCTI. We can enrich indicators, identify shared infrastructure, compare it against our own telemetry, and investigate whether those relationships provide opportunities for new detections.
And this is where I see the real value of Threat Hunting. Not every new article requires another detection rule, especially when we already monitor the technique. Sometimes the opportunity is somewhere else, hidden in the relationships between the published indicators.
I’m not suggesting that we stop collecting IoCs. I will continue using them in my investigations and automation workflows. But rather than stopping at an exact match, I prefer to ask what else we can learn from them.
IoCs tell us what has already been observed. Investigating their patterns may help us identify what comes next. And for me, that’s exactly what Threat Hunting is about.
Beyond IoCs: Start Hunting Their Patterns was originally published in Detect FYI on Medium, where people are continuing the conversation by highlighting and responding to this story.
Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.
Article Link: https://detect.fyi/beyond-iocs-start-hunting-their-patterns-8609bf2f9ac9?source=rss----d5fd8f494f6a---4