2026-04-13 01-59-34

0:10

S… Speaker 1 (2026-04-13 01-59-34)

In this video,

0:11

S… Speaker 1 (2026-04-13 01-59-34)

we're going to start taking a look at some specific IOCs

0:15

S… Speaker 1 (2026-04-13 01-59-34)

that are associated with endpoint threat hunting.

0:19

S… Speaker 2 (2026-04-13 01-59-34)

Now remember,

0:19

S… Speaker 1 (2026-04-13 01-59-34)

we're just looking at endpoint -specific IOCs in this video,

0:24

S… Speaker 1 (2026-04-13 01-59-34)

but any IOC can be used to search on your

0:28

S… Speaker 1 (2026-04-13 01-59-34)

endpoints or search in logs that are generated from

0:32

S… Speaker 2 (2026-04-13 01-59-34)

the endpoints,

0:33

S… Speaker 1 (2026-04-13 01-59-34)

including your network -based IOCs.

0:36

S… Speaker 1 (2026-04-13 01-59-34)

So just keep that in mind.

0:37

S… Speaker 1 (2026-04-13 01-59-34)

We're talking about specifically IOCs that are associated with

0:41

S… Speaker 1 (2026-04-13 01-59-34)

endpoint systems right now.

0:43

S… Speaker 1 (2026-04-13 01-59-34)

So we'll start off that conversation by talking about your file

0:47

S… Speaker 1 (2026-04-13 01-59-34)

-based IOCs.

0:49

S… Speaker 1 (2026-04-13 01-59-34)

These are going to be things like your file names,

0:51

S… Speaker 1 (2026-04-13 01-59-34)

file hashes,

0:53

S… Speaker 1 (2026-04-13 01-59-34)

things like that.

0:55

S… Speaker 1 (2026-04-13 01-59-34)

Now, file names as an IOC really aren't

0:59

S… Speaker 1 (2026-04-13 01-59-34)

the most reliable source because file names can

1:03

S… Speaker 1 (2026-04-13 01-59-34)

easily be changed,

1:05

S… Speaker 1 (2026-04-13 01-59-34)

and attackers are very commonly going to do this.

1:08

S… Speaker 1 (2026-04-13 01-59-34)

This is still a useful IOC

1:12

S… Speaker 1 (2026-04-13 01-59-34)

to search for.

1:15

S… Speaker 1 (2026-04-13 01-59-34)

I would still recommend searching for them because they can be a

1:19

S… Speaker 1 (2026-04-13 01-59-34)

unique file name you could be searching for.

1:21

S… Speaker 1 (2026-04-13 01-59-34)

It could be a known pattern you're searching for,

1:24

S… Speaker 2 (2026-04-13 01-59-34)

anything like that.

1:25

S… Speaker 2 (2026-04-13 01-59-34)

Remember,

1:26

S… Speaker 1 (2026-04-13 01-59-34)

if a malicious file name is found,

1:29

S… Speaker 1 (2026-04-13 01-59-34)

if a malicious IOC that is a file name is found,

1:32

S… Speaker 1 (2026-04-13 01-59-34)

that's a good indicator.

1:34

S… Speaker 1 (2026-04-13 01-59-34)

But don't make the mistake of thinking just

1:38

S… Speaker 1 (2026-04-13 01-59-34)

because you didn't.

1:39

S… Speaker 1 (2026-04-13 01-59-34)

find a malicious file name or the file name associated with that

1:43

S… Speaker 1 (2026-04-13 01-59-34)

or the IOC associated with that file name.

1:46

S… Speaker 1 (2026-04-13 01-59-34)

that there isn't any sort of compromise or anything

1:51

S… Speaker 1 (2026-04-13 01-59-34)

on that.

1:51

S… Speaker 1 (2026-04-13 01-59-34)

It is not a true negative because these file names can be easily

1:55

S… Speaker 2 (2026-04-13 01-59-34)

changed.

1:56

S… Speaker 1 (2026-04-13 01-59-34)

So just keep that in mind when you're doing your threat hunts.

1:59

S… Speaker 1 (2026-04-13 01-59-34)

File hashes are very similar.

2:01

S… Speaker 1 (2026-04-13 01-59-34)

Most of the time when we're talking about file hashes as IOCs,

2:05

S… Speaker 1 (2026-04-13 01-59-34)

these are going to take the form of your MD5 hashes or your

2:09

S… Speaker 1 (2026-04-13 01-59-34)

SHA -256 hashes.

2:12

S… Speaker 1 (2026-04-13 01-59-34)

There's MD5 and SHA -256 examples there on

2:16

S… Speaker 1 (2026-04-13 01-59-34)

the screen.

2:17

S… Speaker 2 (2026-04-13 01-59-34)

Again,

2:18

S… Speaker 1 (2026-04-13 01-59-34)

these are fairly easy to modify.

2:20

S… Speaker 1 (2026-04-13 01-59-34)

Just changing one bit of a file is enough to get a completely

2:25

S… Speaker 2 (2026-04-13 01-59-34)

different file hash.

2:27

S… Speaker 1 (2026-04-13 01-59-34)

So the same kind of guidance that we just talked about with file names goes

2:32

S… Speaker 1 (2026-04-13 01-59-34)

with the file hashes as well.

2:35

S… Speaker 1 (2026-04-13 01-59-34)

File paths and file sizes can be used

2:39

S… Speaker 1 (2026-04-13 01-59-34)

as file -based IOCs as well.

2:42

S… Speaker 2 (2026-04-13 01-59-34)

Again,

2:43

S… Speaker 1 (2026-04-13 01-59-34)

with any of your file -based IOCs,

2:46

S… Speaker 1 (2026-04-13 01-59-34)

just use caution with those.

2:48

S… Speaker 1 (2026-04-13 01-59-34)

The absence of an IOC doesn't mean it's a true negative

2:52

S… Speaker 1 (2026-04-13 01-59-34)

here.

2:52

S… Speaker 1 (2026-04-13 01-59-34)

Now, that goes with any of your IOCs,

2:55

S… Speaker 1 (2026-04-13 01-59-34)

but specifically with file -based ones because they are trivial to change.

3:00

S… Speaker 1 (2026-04-13 01-59-34)

And it may not affect the attacker's attack one bit if they change

3:04

S… Speaker 1 (2026-04-13 01-59-34)

the file name or if they change a single bit in a file to get a new file

3:08

S… Speaker 2 (2026-04-13 01-59-34)

hash or anything like that.

3:10

S… Speaker 1 (2026-04-13 01-59-34)

But these can still be useful.

3:12

S… Speaker 1 (2026-04-13 01-59-34)

If you do find these IOCs during a threat hunt,

3:16

S… Speaker 1 (2026-04-13 01-59-34)

then that's a good indicator that you need to continue that threat hunt and continue

3:20

S… Speaker 2 (2026-04-13 01-59-34)

down that path.

3:21

S… Speaker 1 (2026-04-13 01-59-34)

Maybe pivot the threat hunt to go in a new direction depending on

3:25

S… Speaker 2 (2026-04-13 01-59-34)

what you find.

3:27

S… Speaker 1 (2026-04-13 01-59-34)

They still can be useful, just don't fall into the trap there.

3:31

S… Speaker 1 (2026-04-13 01-59-34)

We also have some specific Windows -specific based

3:35

S… Speaker 1 (2026-04-13 01-59-34)

IOCs,

3:36

S… Speaker 1 (2026-04-13 01-59-34)

starting with your registry keys.

3:38

S… Speaker 1 (2026-04-13 01-59-34)

Registry keys,

3:39

S… Speaker 1 (2026-04-13 01-59-34)

scheduled tasks,

3:40

S… Speaker 1 (2026-04-13 01-59-34)

services,

3:41

S… Speaker 1 (2026-04-13 01-59-34)

we're going to talk about all of these here.

3:43

S… Speaker 1 (2026-04-13 01-59-34)

These are very commonly used by attackers as persistence

3:47

S… Speaker 1 (2026-04-13 01-59-34)

mechanisms for usually either auto

3:51

S… Speaker 1 (2026-04-13 01-59-34)

-run for your registry or creating new services that start at a

3:55

S… Speaker 1 (2026-04-13 01-59-34)

certain time.

3:57

S… Speaker 1 (2026-04-13 01-59-34)

Scheduled tasks,

3:58

S… Speaker 1 (2026-04-13 01-59-34)

kind of self -explanatory there.

3:59

S… Speaker 1 (2026-04-13 01-59-34)

They're used for attackers or by attackers to make sure they can maintain access

4:04

S… Speaker 1 (2026-04-13 01-59-34)

to the systems.

4:05

S… Speaker 1 (2026-04-13 01-59-34)

So good things to search for and can be very valuable IOCs.

4:09

S… Speaker 1 (2026-04-13 01-59-34)

For registry keys,

4:10

S… Speaker 1 (2026-04-13 01-59-34)

when you're searching for the registry key IOCs in your threat hunt,

4:14

S… Speaker 1 (2026-04-13 01-59-34)

one of the main things you want to search for is the command reg add,

4:18

S… Speaker 1 (2026-04-13 01-59-34)

the command line command there to create a new

4:23

S… Speaker 1 (2026-04-13 01-59-34)

registry key.

4:24

S… Speaker 1 (2026-04-13 01-59-34)

A common location to look for your kind

4:28

S… Speaker 1 (2026-04-13 01-59-34)

of auto run is under Windows current version run.

4:32

S… Speaker 1 (2026-04-13 01-59-34)

The full key is there on the screen.

4:34

S… Speaker 1 (2026-04-13 01-59-34)

That's a very common place to find your auto run locations

4:39

S… Speaker 1 (2026-04-13 01-59-34)

for things that start up when Windows starts up or when a user logs in.

4:43

S… Speaker 1 (2026-04-13 01-59-34)

There are others as well.

4:45

S… Speaker 2 (2026-04-13 01-59-34)

But again,

4:46

S… Speaker 1 (2026-04-13 01-59-34)

make sure that you're searching for whatever specific IOC is

4:50

S… Speaker 2 (2026-04-13 01-59-34)

applicable to your threat hunt.

4:53

S… Speaker 1 (2026-04-13 01-59-34)

You can also use Sysmon events.

4:56

S… Speaker 1 (2026-04-13 01-59-34)

Event IDs 12,

4:57

S… Speaker 1 (2026-04-13 01-59-34)

13, and 14 are all tied to...

5:00

S… Speaker 2 (2026-04-13 01-59-34)

registry activity,

5:01

S… Speaker 2 (2026-04-13 01-59-34)

12 being a create or a delete registry key,

5:05

S… Speaker 2 (2026-04-13 01-59-34)

13 being setting a value to a registry key,

5:10

S… Speaker 2 (2026-04-13 01-59-34)

and 14 is renaming a key or

5:14

S… Speaker 1 (2026-04-13 01-59-34)

a value itself.

5:15

S… Speaker 2 (2026-04-13 01-59-34)

And you also have Windows event ID 4657,

5:20

S… Speaker 2 (2026-04-13 01-59-34)

and that's just a generic registry value was

5:25

S… Speaker 1 (2026-04-13 01-59-34)

modified ID.

5:26

S… Speaker 2 (2026-04-13 01-59-34)

So all of those can be useful for searching for any sort

5:30

S… Speaker 2 (2026-04-13 01-59-34)

of malicious modifications to the registry.

5:33

S… Speaker 2 (2026-04-13 01-59-34)

And then we have our scheduled task.

5:36

S… Speaker 1 (2026-04-13 01-59-34)

Again, with the command line,

5:37

S… Speaker 2 (2026-04-13 01-59-34)

you can have schtasks and then forward slash create.

5:42

S… Speaker 2 (2026-04-13 01-59-34)

as a good indicator to look for if you find that it is an indicator that an

5:46

S… Speaker 2 (2026-04-13 01-59-34)

attacker has created a new scheduled task.

5:49

S… Speaker 1 (2026-04-13 01-59-34)

And again,

5:50

S… Speaker 2 (2026-04-13 01-59-34)

this doesn't necessarily mean it's malicious.

5:53

S… Speaker 2 (2026-04-13 01-59-34)

Maybe an administrator did it,

5:54

S… Speaker 2 (2026-04-13 01-59-34)

but it's a good indicator to search for.

5:57

S… Speaker 1 (2026-04-13 01-59-34)

You can also search for,

5:59

S… Speaker 2 (2026-04-13 01-59-34)

there's three different Windows event IDs.

6:02

S… Speaker 2 (2026-04-13 01-59-34)

You have 4698,

6:04

S… Speaker 2 (2026-04-13 01-59-34)

which is a scheduled task was created.

6:06

S… Speaker 1 (2026-04-13 01-59-34)

4701,

6:08

S… Speaker 2 (2026-04-13 01-59-34)

not normally going to be searched for,

6:09

S… Speaker 2 (2026-04-13 01-59-34)

but good to keep in mind.

6:11

S… Speaker 2 (2026-04-13 01-59-34)

Scheduled task being disabled,

6:12

S… Speaker 2 (2026-04-13 01-59-34)

that can still be suspicious or malicious.

6:15

S… Speaker 2 (2026-04-13 01-59-34)

Or 4702,

6:17

S… Speaker 2 (2026-04-13 01-59-34)

a scheduled task was modified.

6:19

S… Speaker 2 (2026-04-13 01-59-34)

An attacker may modify an existing scheduled task if

6:23

S… Speaker 2 (2026-04-13 01-59-34)

they have rights to do it to kind of help mask their activities as

6:27

S… Speaker 1 (2026-04-13 01-59-34)

well.

6:28

S… Speaker 2 (2026-04-13 01-59-34)

And then you have various different Windows services that are commonly

6:32

S… Speaker 1 (2026-04-13 01-59-34)

abused.

6:33

S… Speaker 2 (2026-04-13 01-59-34)

You can have existing Windows services that are abused or

6:37

S… Speaker 2 (2026-04-13 01-59-34)

new Windows services that an attacker creates.

6:40

S… Speaker 2 (2026-04-13 01-59-34)

You have a command line,

6:41

S… Speaker 2 (2026-04-13 01-59-34)

again, sc .exe.

6:45

S… Speaker 1 (2026-04-13 01-59-34)

That is,

6:46

S… Speaker 2 (2026-04-13 01-59-34)

again, command line used for an attacker to create a new malicious Windows

6:50

S… Speaker 1 (2026-04-13 01-59-34)

service.

6:52

S… Speaker 1 (2026-04-13 01-59-34)

And you also have,

6:53

S… Speaker 1 (2026-04-13 01-59-34)

again, event IDs.

6:55

S… Speaker 2 (2026-04-13 01-59-34)

There's two specific Windows event IDs,

6:58

S… Speaker 2 (2026-04-13 01-59-34)

one newer than the other,

7:00

S… Speaker 2 (2026-04-13 01-59-34)

that are used or associated with new services being created.

7:04

S… Speaker 2 (2026-04-13 01-59-34)

It's 4698 and 7045 are

7:08

S… Speaker 2 (2026-04-13 01-59-34)

both associated with new Windows services.

7:12

S… Speaker 2 (2026-04-13 01-59-34)

And some more Windows -specific IOCs,

7:16

S… Speaker 2 (2026-04-13 01-59-34)

you have your Windows processes.

7:21

S… Speaker 2 (2026-04-13 01-59-34)

process when we're talking about that.

7:23

S… Speaker 2 (2026-04-13 01-59-34)

We're referring to really any executable running on the machine

7:27

S… Speaker 2 (2026-04-13 01-59-34)

or a specific Windows system process.

7:31

S… Speaker 2 (2026-04-13 01-59-34)

Windows processes can refer to either of those,

7:35

S… Speaker 1 (2026-04-13 01-59-34)

so keep that in mind.

7:37

S… Speaker 2 (2026-04-13 01-59-34)

Any process can be malicious in nature depending on

7:41

S… Speaker 1 (2026-04-13 01-59-34)

what it is.

7:42

S… Speaker 2 (2026-04-13 01-59-34)

Some keys to look for are unusually named

7:46

S… Speaker 2 (2026-04-13 01-59-34)

processes that are running on a system.

7:50

S… Speaker 2 (2026-04-13 01-59-34)

Maybe one that is kind of named to perhaps

7:54

S… Speaker 2 (2026-04-13 01-59-34)

match a legitimate Windows process.

7:57

S… Speaker 2 (2026-04-13 01-59-34)

Or there are some processes in Windows,

8:00

S… Speaker 2 (2026-04-13 01-59-34)

some system processes,

8:02

S… Speaker 2 (2026-04-13 01-59-34)

that should only be running one time or should only be two

8:06

S… Speaker 2 (2026-04-13 01-59-34)

instances of it.

8:07

S… Speaker 2 (2026-04-13 01-59-34)

One instance or two instance.

8:08

S… Speaker 1 (2026-04-13 01-59-34)

So if you see,

8:10

S… Speaker 2 (2026-04-13 01-59-34)

you know, three instances of one of those processes that should only have

8:14

S… Speaker 1 (2026-04-13 01-59-34)

one instance,

8:15

S… Speaker 1 (2026-04-13 01-59-34)

that's usually appropriate.

8:17

S… Speaker 2 (2026-04-13 01-59-34)

really good indicator that something malicious is going on on that

8:21

S… Speaker 1 (2026-04-13 01-59-34)

system.

8:22

S… Speaker 1 (2026-04-13 01-59-34)

Again,

8:23

S… Speaker 2 (2026-04-13 01-59-34)

you can have files that may look like

8:27

S… Speaker 2 (2026-04-13 01-59-34)

they are legitimate system processes that are malicious in

8:32

S… Speaker 1 (2026-04-13 01-59-34)

nature.

8:32

S… Speaker 2 (2026-04-13 01-59-34)

Besides a lot of the event IDs we've already talked about,

8:36

S… Speaker 2 (2026-04-13 01-59-34)

there's several others that can be used,

8:38

S… Speaker 1 (2026-04-13 01-59-34)

and there are many,

8:39

S… Speaker 2 (2026-04-13 01-59-34)

many more event IDs than just these that can be used for hunting.

8:44

S… Speaker 2 (2026-04-13 01-59-34)

Always the key is to research what

8:48

S… Speaker 2 (2026-04-13 01-59-34)

you're hunting for and what event IDs might

8:53

S… Speaker 2 (2026-04-13 01-59-34)

apply to whatever specific activity you're looking

8:57

S… Speaker 1 (2026-04-13 01-59-34)

for.

8:57

S… Speaker 1 (2026-04-13 01-59-34)

So, for example,

8:58

S… Speaker 2 (2026-04-13 01-59-34)

if you're looking for maybe the attacker cleared the audit

9:02

S… Speaker 2 (2026-04-13 01-59-34)

logs to cover their tracks,

9:03

S… Speaker 2 (2026-04-13 01-59-34)

you'd look for event ID 1102.

9:07

S… Speaker 2 (2026-04-13 01-59-34)

or if you're looking specifically for successful and failed logins

9:11

S… Speaker 1 (2026-04-13 01-59-34)

to a system,

9:12

S… Speaker 2 (2026-04-13 01-59-34)

those are very commonly used in threat hunts,

9:15

S… Speaker 2 (2026-04-13 01-59-34)

you'd be looking for event ID 4624 and 4625.

9:21

S… Speaker 2 (2026-04-13 01-59-34)

PowerShell is also very,

9:25

S… Speaker 2 (2026-04-13 01-59-34)

very commonly used by attackers for many

9:29

S… Speaker 2 (2026-04-13 01-59-34)

different purposes.

9:33

S… Speaker 2 (2026-04-13 01-59-34)

Two events that are good for just looking at any PowerShell

9:37

S… Speaker 2 (2026-04-13 01-59-34)

commands or cmdlets that are run on a system is 4103 for

9:41

S… Speaker 2 (2026-04-13 01-59-34)

different logging for PowerShell modules and 4104

9:46

S… Speaker 2 (2026-04-13 01-59-34)

for script block logging.

9:48

S… Speaker 2 (2026-04-13 01-59-34)

There's a few different commandlets that are commonly associated

9:53

S… Speaker 2 (2026-04-13 01-59-34)

with malicious activity.

9:54

S… Speaker 1 (2026-04-13 01-59-34)

Again,

9:55

S… Speaker 2 (2026-04-13 01-59-34)

they can be associated with regular system administration as

9:59

S… Speaker 2 (2026-04-13 01-59-34)

well, but it's a good thing to research more if you do find these

10:03

S… Speaker 1 (2026-04-13 01-59-34)

indicators.

10:04

S… Speaker 2 (2026-04-13 01-59-34)

One of those commandlets is invoke expression.

10:07

S… Speaker 2 (2026-04-13 01-59-34)

It can also appear in the logs as just IEX,

10:11

S… Speaker 2 (2026-04-13 01-59-34)

depending on how the attacker typed

10:15

S… Speaker 1 (2026-04-13 01-59-34)

it in.

10:17

S… Speaker 2 (2026-04-13 01-59-34)

You can also have invoke web requests.

10:19

S… Speaker 2 (2026-04-13 01-59-34)

That is a very common one that attackers use when they're trying to download

10:23

S… Speaker 2 (2026-04-13 01-59-34)

malicious payloads.

10:25

S… Speaker 2 (2026-04-13 01-59-34)

It can also be abbreviated in the command line or the PowerShell prompt as IWR.

10:31

S… Speaker 2 (2026-04-13 01-59-34)

And then if you see any PowerShell commands or any PowerShell executables

10:35

S… Speaker 2 (2026-04-13 01-59-34)

that has the encoded command option or flag

10:39

S… Speaker 2 (2026-04-13 01-59-34)

with it, basically that means that what you see in the logs is

10:43

S… Speaker 2 (2026-04-13 01-59-34)

going to be typically base 64 encoded.

10:46

S… Speaker 2 (2026-04-13 01-59-34)

So you can't readily see whatever it is the attacker

10:50

S… Speaker 2 (2026-04-13 01-59-34)

did in that PowerShell command.

10:53

S… Speaker 2 (2026-04-13 01-59-34)

You'd need to decode that first.

10:56

S… Speaker 2 (2026-04-13 01-59-34)

That is done by attackers primarily to kind of evade the more

11:00

S… Speaker 2 (2026-04-13 01-59-34)

automated monitoring and alerting for certain things like

11:04

S… Speaker 2 (2026-04-13 01-59-34)

downloading malicious payloads using PowerShell.

11:07

S… Speaker 1 (2026-04-13 01-59-34)

They'll encode it.

11:08

S… Speaker 2 (2026-04-13 01-59-34)

so that it's not as readily available or visible

11:12

S… Speaker 2 (2026-04-13 01-59-34)

what the command actually was.

11:15

S… Speaker 2 (2026-04-13 01-59-34)

Very easy to decode and be able to see what the command was.

11:19

S… Speaker 1 (2026-04-13 01-59-34)

But those are,

11:20

S… Speaker 1 (2026-04-13 01-59-34)

you know,

11:21

S… Speaker 2 (2026-04-13 01-59-34)

a good set of PowerShell indicators to be on the look for

11:25

S… Speaker 2 (2026-04-13 01-59-34)

when you're performing your endpoint threat hunts.

11:28

S… Speaker 2 (2026-04-13 01-59-34)

Then we have some just other IOCs and also some behavioral

11:32

S… Speaker 2 (2026-04-13 01-59-34)

-based IOCs that are associated with your endpoints.

11:36

S… Speaker 2 (2026-04-13 01-59-34)

Any sort of unexplained activity,

11:38

S… Speaker 2 (2026-04-13 01-59-34)

any sort of unusual activity,

11:41

S… Speaker 1 (2026-04-13 01-59-34)

again, you're going to have to know what normal looks like in the environment,

11:45

S… Speaker 2 (2026-04-13 01-59-34)

and that goes with your baselines as well.

11:48

S… Speaker 2 (2026-04-13 01-59-34)

Any sort of deviation from your baselines,

11:50

S… Speaker 2 (2026-04-13 01-59-34)

any unusual activity can be considered a form of IOC.

11:55

S… Speaker 2 (2026-04-13 01-59-34)

You have your behavioral IOCs.

11:58

S… Speaker 2 (2026-04-13 01-59-34)

What that exactly looks like is going to depend,

12:02

S… Speaker 1 (2026-04-13 01-59-34)

number one,

12:02

S… Speaker 2 (2026-04-13 01-59-34)

on what the attack actually is,

12:05

S… Speaker 2 (2026-04-13 01-59-34)

what the attacker is doing,

12:06

S… Speaker 2 (2026-04-13 01-59-34)

but also what your environment looks like.

12:09

S… Speaker 2 (2026-04-13 01-59-34)

This can be things like security settings that might have

12:13

S… Speaker 1 (2026-04-13 01-59-34)

been modified,

12:14

S… Speaker 2 (2026-04-13 01-59-34)

firewall configurations that might have been changed,

12:16

S… Speaker 2 (2026-04-13 01-59-34)

specifically your local firewalls,

12:19

S… Speaker 1 (2026-04-13 01-59-34)

say on a Windows endpoint.

12:20

S… Speaker 1 (2026-04-13 01-59-34)

Things like that.

12:21

S… Speaker 2 (2026-04-13 01-59-34)

And additional installed software,

12:23

S… Speaker 1 (2026-04-13 01-59-34)

or again,

12:24

S… Speaker 2 (2026-04-13 01-59-34)

processes that are running that might be different from what's normal,

12:28

S… Speaker 2 (2026-04-13 01-59-34)

from what the baseline is on that particular endpoint.

12:33

S… Speaker 2 (2026-04-13 01-59-34)

Phishing is a very common technique that

12:38

S… Speaker 2 (2026-04-13 01-59-34)

is used by attackers to kind of start an attack,

12:41

S… Speaker 2 (2026-04-13 01-59-34)

to get on the network,

12:42

S… Speaker 1 (2026-04-13 01-59-34)

get in the systems.

12:43

S… Speaker 2 (2026-04-13 01-59-34)

And phishing is a form of IOC,

12:46

S… Speaker 1 (2026-04-13 01-59-34)

both the email itself,

12:48

S… Speaker 2 (2026-04-13 01-59-34)

but also your indicators inside the email.

12:51

S… Speaker 2 (2026-04-13 01-59-34)

Those can be IP addresses or domains in the form of URLs

12:55

S… Speaker 1 (2026-04-13 01-59-34)

in the message.

12:57

S… Speaker 2 (2026-04-13 01-59-34)

Or it can be files that are attached to the email itself.

13:01

S… Speaker 2 (2026-04-13 01-59-34)

All of those can be considered IOCs and can be searched for

13:05

S… Speaker 1 (2026-04-13 01-59-34)

during a threat hunt.

13:06

S… Speaker 2 (2026-04-13 01-59-34)

Any new user creation.

13:09

S… Speaker 2 (2026-04-13 01-59-34)

Now, that's a very normal thing to see in an enterprise environment.

13:12

S… Speaker 2 (2026-04-13 01-59-34)

But any new user creation that can't be explained,

13:16

S… Speaker 2 (2026-04-13 01-59-34)

any new user creation that is abnormal.

13:19

S… Speaker 2 (2026-04-13 01-59-34)

If you're talking about a Windows Active Directory environment,

13:22

S… Speaker 2 (2026-04-13 01-59-34)

you'd be looking for local user creation.

13:26

S… Speaker 1 (2026-04-13 01-59-34)

Typically,

13:27

S… Speaker 2 (2026-04-13 01-59-34)

it may be used by system administrators,

13:30

S… Speaker 2 (2026-04-13 01-59-34)

maybe some applications sometimes require it,

13:33

S… Speaker 1 (2026-04-13 01-59-34)

things like that,

13:34

S… Speaker 2 (2026-04-13 01-59-34)

but it's something to be on the look for,

13:36

S… Speaker 2 (2026-04-13 01-59-34)

a lookout for.

13:38

S… Speaker 2 (2026-04-13 01-59-34)

These are very common techniques that are used by attackers for persistence.

13:42

S… Speaker 2 (2026-04-13 01-59-34)

They'll create new local accounts on a system that they have

13:46

S… Speaker 2 (2026-04-13 01-59-34)

compromised in order to maintain their access.

13:50

S… Speaker 2 (2026-04-13 01-59-34)

And you would associate that with event ID 4720.

13:53

S… Speaker 2 (2026-04-13 01-59-34)

So that would be something specific you could look for to see if a

13:57

S… Speaker 2 (2026-04-13 01-59-34)

new account has been created.

14:00

S… Speaker 2 (2026-04-13 01-59-34)

There's many different methods that attackers can use

14:04

S… Speaker 2 (2026-04-13 01-59-34)

to download malware onto a system or whatever payload they're

14:08

S… Speaker 1 (2026-04-13 01-59-34)

working with.

14:08

S… Speaker 2 (2026-04-13 01-59-34)

A lot of times you'll see this done with either PowerShell,

14:12

S… Speaker 2 (2026-04-13 01-59-34)

and we discussed a couple of the techniques they use in PowerShell,

14:15

S… Speaker 2 (2026-04-13 01-59-34)

but there's many other utilities that can be used,

14:18

S… Speaker 2 (2026-04-13 01-59-34)

including some built into Windows like the certutil .exe.

14:23

S… Speaker 2 (2026-04-13 01-59-34)

That can be used to download malicious payloads.

14:27

S… Speaker 2 (2026-04-13 01-59-34)

by an attacker so there's a lot of different types of iocs

14:32

S… Speaker 2 (2026-04-13 01-59-34)

that are associated with endpoints we're focusing mainly on the

14:36

S… Speaker 2 (2026-04-13 01-59-34)

windows ones in this course but a good idea of

14:40

S… Speaker 2 (2026-04-13 01-59-34)

you know some of the things that you can be looking for and we're going to keep talking about these

14:44

S… Speaker 2 (2026-04-13 01-59-34)

iocs you're going to keep seeing these used as we progress through

14:48

S… Speaker 2 (2026-04-13 01-59-34)

this course as well

2026-04-13 01-59-34

Resumit

Demandar a l'IA sus aquesta transcripcion