Which indicators are useful for command and control, malware delivery, identifying the operating system, and other tasks, such as URLs, domain names, and IP addresses?

Which indicators are useful for command and control, malware delivery, identifying the operating system, and other tasks, such as URLs, domain names, and IP addresses?

• A. Atomic indicators
• B. Host-Based Indicators
• C. Email Indicators
• D. Network Indicators

Answer: (D)

Network indicators are the signals observed in traffic that reveal who is communicating, where they’re communicating to, and how they’re doing it. This category includes IP addresses, domain names, URLs, DNS queries, port numbers, protocols, and patterns in the traffic that point to malicious infrastructure or behaviors. Because command-and-control channels, malware delivery, and many attacker techniques show up as specific network destinations or traffic patterns, network indicators are the most direct way to detect and analyze these activities across multiple systems and networks. They also can provide hints about the operating environment through network-revealed details like banners or characteristic TCP/IP responses, although host-based data often gives more definitive OS information. The strength lies in the ability to correlate across network sensors (firewalls, IDS/IPS, proxies) to identify and investigate suspicious URLs, domain names, and IP addresses.

Network indicators are the signals observed in traffic that reveal who is communicating, where they’re communicating to, and how they’re doing it. This category includes IP addresses, domain names, URLs, DNS queries, port numbers, protocols, and patterns in the traffic that point to malicious infrastructure or behaviors. Because command-and-control channels, malware delivery, and many attacker techniques show up as specific network destinations or traffic patterns, network indicators are the most direct way to detect and analyze these activities across multiple systems and networks. They also can provide hints about the operating environment through network-revealed details like banners or characteristic TCP/IP responses, although host-based data often gives more definitive OS information. The strength lies in the ability to correlate across network sensors (firewalls, IDS/IPS, proxies) to identify and investigate suspicious URLs, domain names, and IP addresses.