DevOps-Security-Agent-Skills/security/operations/incident-response/references/ioc-hunting.md

Indicator of Compromise (IOC) Hunting Guide

Common IOC Types

Type	Description	Example
IP Address	Malicious source/destination	192.168.1.100
Domain	C2 or phishing domain	malware.evil.com
File Hash	Malware signature	SHA256:abc123...
File Path	Suspicious file location	/tmp/.hidden
Process	Malicious process name	cryptominer
User	Compromised account	admin

Log Hunting Queries

SSH Brute Force Detection

# Failed SSH attempts
grep "Failed password" /var/log/auth.log | \
  awk '{print $(NF-3)}' | sort | uniq -c | sort -rn | head

# Successful logins after failures
grep -E "Accepted|Failed" /var/log/auth.log | \
  grep -B5 "Accepted" | grep "Failed"

Suspicious Process Activity

# Processes running from /tmp
ps aux | grep -E "^.*/tmp/|^.*/dev/shm/"

# Hidden processes
ps aux | awk '$11 ~ /^\./'

# Processes with deleted binaries
ls -la /proc/*/exe 2>/dev/null | grep deleted

# Unusual parent-child relationships
ps -eo pid,ppid,cmd | grep -E "bash.*-c|sh.*-c"

Network IOCs

# Connections to known bad ports
ss -anp | grep -E ":4444|:5555|:6666|:31337"

# Outbound connections from unusual processes
ss -anp | grep -v -E "chrome|firefox|curl|wget" | grep ESTAB

# DNS queries to suspicious domains
grep -E "query.*\.(tk|ml|ga|cf|gq)$" /var/log/syslog

# Large outbound transfers
ss -anp | awk '$3 > 1000000'

File System IOCs

# Recently modified files in sensitive locations
find /etc /usr/bin /usr/sbin -mtime -1 -ls 2>/dev/null

# Files with suspicious permissions
find / -perm -4000 -o -perm -2000 -ls 2>/dev/null

# Hidden files
find / -name ".*" -type f -ls 2>/dev/null | head -50

# World-writable files
find / -perm -002 -type f -ls 2>/dev/null

User Activity IOCs

# Recent sudo usage
grep sudo /var/log/auth.log | tail -50

# Users logged in from multiple IPs
last | awk '{print $1, $3}' | sort | uniq -c | sort -rn

# SSH keys added recently
find /home -name "authorized_keys" -mtime -7 -ls

# Unusual cron jobs
for user in $(cut -d: -f1 /etc/passwd); do
  crontab -l -u $user 2>/dev/null | grep -v "^#"
done

AWS CloudTrail Hunting

# Console logins from unusual locations
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=ConsoleLogin \
  --query 'Events[*].[CloudTrailEvent]' --output text | jq '.'

# Root account usage
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=Username,AttributeValue=root

# Security group changes
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=AuthorizeSecurityGroupIngress

YARA Rule Example

rule Suspicious_Shell_Script {
    meta:
        description = "Detects suspicious shell scripts"
        severity = "medium"
    strings:
        $s1 = "curl" ascii
        $s2 = "wget" ascii
        $s3 = "/dev/tcp/" ascii
        $s4 = "base64 -d" ascii
        $s5 = "chmod +x" ascii
    condition:
        3 of them
}

Response Actions

Block IOC

# Block IP
iptables -I INPUT -s <IP> -j DROP
iptables -I OUTPUT -d <IP> -j DROP

# Block domain (via hosts)
echo "127.0.0.1 malicious.domain.com" >> /etc/hosts

# Kill process
kill -9 <PID>

Preserve Evidence

# Capture process memory
gcore <PID>

# Copy suspicious file
cp --preserve=all /path/to/file /evidence/

# Capture network traffic
tcpdump -i any -w /evidence/capture.pcap &