Network and Endpoint IoCs for Proactive Detection
Network and endpoint IoCs are the raw material of proactive detection; this domain tests whether you know which indicators are durable, which decay in hours, and how to pivot between them without drowning in false positives.
The pyramid and indicator classes
David Bianco's Pyramid of Pain ranks indicators by how much they cost an adversary to change: hash values (trivial), IP addresses, domain names, network and host artefacts, tools, then TTPs (painful). Endpoint IoCs include SHA-256 hashes, named pipes, mutexes, service names, scheduled task names, registry keys, and process lineage such as winword.exe spawning powershell.exe. Network IoCs include C2 domains, URI patterns, user agents, TLS certificate anomalies, JA3 and JA3S fingerprints, and beacon timing.
Behaviour beats atoms
Atomic indicators are cheap to rotate; behavioural patterns persist. A beacon is defined by regularity - equal intervals with small jitter - not by the destination address. Corroborate: a newly registered domain plus an SNI mismatch plus a rare JA3 is far stronger than any one alone.
Worked example
One host makes HTTPS connections every 300 seconds with roughly 10% jitter to a domain registered three days ago; the certificate CN does not match the SNI; the JA3 hash also appears in an unrelated incident. Reasoning: the periodicity establishes beaconing, the certificate mismatch and domain age raise confidence, and the JA3 gives a pivot that survives IP rotation. Search all proxy and EDR telemetry for that JA3 before scoping to a single host.
Traps
- Blocking only hashes, which polymorphic malware changes for free.
- Forgetting IoC decay: an IP may be reassigned to legitimate cloud infrastructure.
- Ignoring internal-to-internal indicators such as SMB sessions and PsExec service names.