Indicators and how to handle them

IOCs: share them, but carefully

Indicators of compromise are the concrete artefacts — the attacker IP 203.0.113.66, the C2 domain, the web-shell path. When you write them into a report or a ticket you defang them so nobody fat-fingers a live malicious link: 203[.]0[.]113[.]66, hxxp://, sync-updates-cdn[.]net.

Collect the obvious network indicator straight from the logs:

grep -hoE '([0-9]{1,3}\.){3}[0-9]{1,3}' /srv/soc-data/nids/eve.json | sort -u

In the terminal

student@vulntech:~$ grep -hoE '([0-9]{1,3}\.){3}[0-9]{1,3}' /srv/soc-data/nids/eve.json | sort -u
10.10.10.33
10.10.10.5
185.220.101.9
203.0.113.66