detection IR threat-intel
Indicator of compromise
An artefact that suggests a compromise: a hash, a name, an address, an email. Useful. Not a strategy.
Knowledge
AllIRacsc-glossaryau-compliancecloudconceptscryptodetectiondnsframeworkshardeningidentityloggingmalwarenetworkpractitionerprivacythreat-intelvulnerability
4 entries
dns detection threat-intel
Passive DNS
Historical DNS answers observed by sensors. Pivot on an IOC. Not a replacement for a live lookup.
detection IR threat-intel
Tactics, techniques, and procedures
How they work, not just which IP they used today. ATT&CK is the common catalogue.
detection IR threat-intel
Threat hunting
Assume they are already in. Ask a question of your logs. Not a dashboard tour.
Definitions informed by ASD's ACSC glossary. cyber.gov.au glossary