Indicator wranglin’ – an approach to dynamically typing IOCs with poor data context

No ratings

Presented at Virus Bulletin 2024 by

Noah Dunn

The efficacy of an incident response organization relies on their ability to intake, process, and make use of swathes of data. When the key factor in these operations is speed, the indicators of compromise (IOCs) are the 'clues' that enable consultants to 'solve the mystery' of an incident or breach. By noticing patterns and determining a course of action to triage and remediate issues, incident response consultants provide answers and relief to an organization actively under attack. Due to the high-speed nature of this work, often IOCs that are recorded are done in a messy manner, laden with typos, errors, and mistypes. We propose a means to alleviate this issue which resolves data entry problems after the consultant’s work is finished. Use of a dedicated Python pipeline for dynamic IOC ingestion and analysis constructed by our engineering team provides a two-fold solution that benefits both incident response and threat intelligence. Incident response avoids needing to perform data cleanup and can focus on taking notes. Threat intelligence can make use of accurate cleaned data in any follow-up investigations and research. Maximizing the amount of data we can intake and process accurately allows for a noticeable advantage in dealing with threat actors. The strategy provided here can operate outside of data-specific context, making it available to implement in any environment with raw text input.