ioc-development

Goal

A structured, prioritized indicator set that drives detection and containment, with behaviors (not just atomic indicators) captured so the adversary pays to evade.

Indicator types (climb the Pyramid of Pain)

• Atomic — hashes, IPs, domains, URLs, email addresses (easy for the adversary to change; useful for fast blocking).
• Computed — regexes, YARA conditions, certificate/JA3 hashes, registry/file patterns.
• Behavioral (IOAs / TTPs) — the actions and techniques (ATT&CK) — the most durable and the priority to capture.

Steps

1. Extract from forensic findings/sample: files, network, host, and behavioral indicators. Note context (where seen, confidence, observation time).
2. Validate — filter out benign/legitimate indicators (e.g. shared CDNs, common LOLBins) to avoid false-positive-heavy blocks.
3. Prioritize — emphasize behavioral/TTP indicators over fragile atomic ones; mark which are safe to block vs. monitor-only.
4. Operationalize —
   • Detection: hand TTPs/patterns to detection-engineering:detection-rule-development.
   • Blocking: provide atomic indicators for blocklists (with caveats).
   • Intel: structure for sharing (threat-intelligence), ideally STIX-friendly.

Output

An indicator set: indicator · type · context · confidence · block/monitor · ATT&CK mapping. Feeds detection-engineering and threat-intelligence.

Notes

Atomic indicators are cheap to rotate — lead with behavioral indicators for durable defense. Always validate before blocking: a shared IP or common binary on a blocklist causes outages and alert fatigue. Record confidence so downstream consumers can weigh each indicator.