cyber-collecting-indicators-of-compromise

name	cyber-collecting-indicators-of-compromise
description	Systematically collects, categorizes, and distributes indicators of compromise (IOCs) during and after security incidents to enable detection, blocking, and threat intelligence sharing. Covers network, host, email, and behavioral indicators using STIX/TAXII formats and threat intelligence platforms. Activates for requests involving IOC collection, indicator extraction, threat indicator sharing, co
source	mukul975/Anthropic-Cybersecurity-Skills
license	Apache-2.0
authorized_lab	false
origin_frontmatter	name: collecting-indicators-of-compromise | description: 'Systematically collects, categorizes, and distributes indicators of | compromise (IOCs) during and after security incidents to enable detection, blocking, | and threat intelligence sharing. Covers network, host, email, and behavioral indicators | using STIX/TAXII formats and threat intelligence platforms. Activates for requests | involving IOC collection, indicator extraction, threat indicator sharing, compromise | indicators, S
hide	true

Defensive/analysis cyber skill. Source: mukul975/Anthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.

Collecting Indicators of Compromise

When to Use

• During active incident response to identify and block adversary infrastructure
• Post-incident to document all observed adversary artifacts for future detection
• When sharing threat intelligence with ISACs, sector partners, or law enforcement
• When building detection rules in SIEM, EDR, or network security tools
• When enriching IOCs with threat intelligence context for risk scoring

Do not use for behavioral TTP analysis without accompanying technical indicators; use MITRE ATT&CK mapping for behavioral characterization.

Prerequisites

• Access to incident evidence sources: SIEM logs, EDR telemetry, memory dumps, disk images, network captures
• Threat intelligence platform (MISP, OpenCTI, ThreatConnect) for IOC management and sharing
• IOC enrichment tools: VirusTotal, OTX (AlienVault Open Threat Exchange), Shodan, DomainTools
• STIX 2.1 knowledge for structured IOC representation
• Sharing agreements with relevant ISACs (FS-ISAC, H-ISAC, IT-ISAC) or sector partners

Workflow

Step 1: Identify IOC Categories

Collect indicators across all categories from incident evidence:

Network Indicators:

• IP addresses (C2 servers, staging servers, exfiltration destinations)
• Domain names (C2 domains, phishing domains, DGA domains)
• URLs (malware download, C2 check-in, exfiltration endpoints)
• JA3/JA3S hashes (TLS client/server fingerprints)
• User-Agent strings (custom or unusual HTTP headers)
• DNS query patterns (tunneling signatures, DGA patterns)

Host Indicators:

• File hashes (MD5, SHA-1, SHA-256 of malware, tools, scripts)
• File paths (known malware installation directories)
• Registry keys (persistence mechanisms, configuration storage)
• Scheduled tasks and service names (persistence)
• Mutex/event names (malware instance synchronization)
• Named pipes (C2 communication channels, e.g., Cobalt Strike)

Email Indicators:

• Sender addresses and domains (spoofed or attacker-controlled)
• Subject lines and body content patterns
• Attachment names and hashes
• Embedded URLs