Detecting an Intrusion: IOCs and TTPs

When a crime is solved, detectives look for two kinds of clues: the fingerprint left on a glass, and the habit of the culprit, such as always entering through a window. Cyber defenders have the same two kinds of clues. The fingerprint is an indicator of compromise (IOC); the habit is a tactic, technique or procedure (TTP). Knowing which one you are hunting changes the quality of your detection.

Indicators of compromise (IOCs)

An IOC is a piece of evidence that suggests a system has been compromised, or is being targeted. Typical IOCs include:

• File hashes: the digital fingerprint of a known malicious file.
• IP addresses and domain names used by malicious infrastructure.
• URLs that host malicious content.
• File names or paths and registry keys associated with a malware family.
• Email characteristics: sender addresses, subjects or attachment names used in a known campaign.

IOCs are concrete and easy to search for. If a trusted report says that a hash was seen in an attack, you can search your own logs for it in minutes. That is their strength.

Why IOCs are fragile

The weakness of IOCs is that they are easy for an attacker to change. Recompiling a program changes its hash. Renting a new server changes the address. Registering a new domain takes minutes. An IOC list is like a wanted poster with a photo: useful if the culprit has not changed their appearance, useless if they have.

IOCs also age. An address that was malicious last month may belong to an innocent customer of a hosting service today. Always check the date and the source of an IOC, and consider removing old ones from blocking lists to avoid false positives.

The "Pyramid of Pain"

A well-known way to visualize this is the Pyramid of Pain, a model that ranks indicators by how much trouble it causes the adversary when you detect and block them. From easiest for the attacker to change, at the bottom, to hardest at the top:

1. File hashes: trivial to change.
2. IP addresses: easy to change.
3. Domain names: simple, though a little more work.
4. Network and host artifacts, such as particular request patterns or file locations: annoying to change.
5. Tools: the attacker must find or build new ones.
6. TTPs: the way they operate, which is the hardest to change because it reflects their skills and habits.

The practical message: a detection built on behavior survives longer than one built on a hash.

Tactics, techniques and procedures (TTPs)

• Tactic: the goal at a stage of an attack, such as gaining initial access, moving laterally or stealing credentials.
• Technique: the way to reach that goal, such as sending a phishing message or guessing passwords.
• Procedure: the specific implementation by a group or tool, with its habits.

Analogy: the tactic is "get into the house". The technique is "through a window". The procedure is "this particular burglar always forces the left window of the back room at around 3 a.m. using a flat tool".

Indicators of attack

You will sometimes see the term indicator of attack (IOA). It focuses on what is happening now and on the intent of the activity, for example "a document application launched a command interpreter", rather than on the artifact. IOAs and TTP-based detections are close cousins: both describe behavior.

Examples that show the difference

Observation	Type	Quality of detection
This file has a known malicious hash	IOC	Precise, but evaded by any change to the file
A workstation contacts a known malicious domain	IOC	Useful, but the attacker may switch domains
A service account suddenly requests tickets for many services	TTP	Behavioral, harder to evade and applicable to many tools
An email application spawns a script interpreter, which starts a network connection	TTP / IOA	Behavioral chain that is suspicious in most environments

Threat hunting: looking before the alarm

Automated alerts catch what they were designed to catch. Threat hunting is the proactive search for what slipped through. It starts with a hypothesis: "If an adversary used legitimate remote administration tools to move inside our network, we would see administrative sign-ins on machines that the user never normally uses." Then the hunter searches the data to confirm or reject it. Whatever the result, a hunt produces something: a new detection, a log source to add, a hardening recommendation, or the confirmation that the hypothesis is not an issue. A hunt that finds nothing is not a failure; it validates your coverage.

Using threat intelligence wisely

Threat intelligence gives context about adversaries and their IOCs. To use it well:

• Check the source and date, and distinguish confirmed information from speculation.
• Prefer relevance: does the threat target your sector, region or technologies?
• Use standard formats for sharing, so that tools can exchange indicators.
• Share back when allowed. Communities such as national CERTs, sector groups and trusted peers get stronger together. Remove or generalize sensitive details before sharing.
• Do not drown in feeds. A large list of low-quality indicators produces false positives, not security.

A mini-investigation, step by step

Let us walk through a fictional case in your lab. An analyst receives an alert: workstation WS01 contacted a domain listed in a threat feed.

1. Validate the IOC: what is the source and date of the listing? Is it a known benign service?
2. Scope it: which other machines contacted the same domain? Search the logs for the last weeks.
3. Look for behavior around it: what process on WS01 made the connection? What happened a few minutes before, for example a downloaded file or a new scheduled task?
4. Build the timeline: times, accounts, hosts, in UTC.
5. Decide: false positive, suspicious (continue monitoring), or confirmed (start incident response, covered in lesson 4.4).
6. Improve: if confirmed, extract the behaviors, not only the IOCs, and create detections for them.

Your turn: classify and improve

Classify each observation as IOC or TTP and propose a more resilient detection if it is an IOC:

1. The hash of a file found on a workstation matches a malware report.
2. A user account signs in to dozens of machines in ten minutes, never having done so before.
3. A server contacts an address listed in a threat feed.
4. A scheduled task is created by a remote session shortly after a new administrative sign-in.

See a solution

1. IOC (hash). More resilient: detect the behavior of the program, for instance the way it persists or the process chain it creates, so a recompiled version is still caught.
2. TTP (lateral movement pattern). It is behavior-based already; tune by user role and time, and exclude legitimate administration tools with documented exceptions.
3. IOC (address). Also search for the behavior that led to the connection, and check how old and reliable the entry is. A single address will change soon.
4. TTP (persistence after remote access). Strong behavioral detection; document the expected legitimate sources, for instance the deployment tool.

Portfolio step

Add ioc-vs-ttp.md to 04-detection-response with a one-page explanation of the pyramid in your own words and your solution to the exercise. Include one hunting hypothesis for your lab and the data you would need to test it. Hypothesis-driven thinking is a key signal of potential for blue team and threat hunting jobs.

The next lesson introduces the shared language that connects all these ideas: MITRE ATT&CK.