Which type of indicators are useful for identifying indications of intrusion, such as malicious IP addresses, virus signatures, MD5 hash, and domain names, and are used to identify specific behavior related to malicious activities?

Which type of indicators are useful for identifying indications of intrusion, such as malicious IP addresses, virus signatures, MD5 hash, and domain names, and are used to identify specific behavior related to malicious activities?

• A. Atomic indicators
• B. Computed indicators
• C. Behavioral indicators
• D. Network Indicators

Answer: (B)

Indicators of compromise can be raw data points or signals derived from analyzing those data points to reveal attacker behavior. The described type focuses on taking artifacts such as IP addresses, file signatures, and domain names and processing or correlating them to uncover specific malicious activities or campaigns. These are not just single facts; they’re signals that emerge from combining and scoring the artifacts to point to a concrete intrusion behavior, like a malware family or a C2 pattern. That ability to synthesize multiple artifacts into a meaningful behavioral signal is what computed indicators are all about. In contrast, atomic indicators are individual data points (a single IP, a single hash, a domain), behavioral indicators describe actions or sequences of actions, and network indicators flag characteristics of network traffic.

Indicators of compromise can be raw data points or signals derived from analyzing those data points to reveal attacker behavior. The described type focuses on taking artifacts such as IP addresses, file signatures, and domain names and processing or correlating them to uncover specific malicious activities or campaigns. These are not just single facts; they’re signals that emerge from combining and scoring the artifacts to point to a concrete intrusion behavior, like a malware family or a C2 pattern. That ability to synthesize multiple artifacts into a meaningful behavioral signal is what computed indicators are all about. In contrast, atomic indicators are individual data points (a single IP, a single hash, a domain), behavioral indicators describe actions or sequences of actions, and network indicators flag characteristics of network traffic.