Digital Forensics and Incident Response - Second Edition

Identifying new indicators

During the course of a threat hunt, new indicators may be discovered. A search of a memory image for a specific family of malware reveals a previously unknown and undetected IP address. These are the top 10 indicators that may be identified in a threat hunt:

• Unusual outbound network traffic
• Anomalies in privileged user accounts
• Geographical anomalies
• Excessive login failures
• Excessive database read volume
• HTML response sizes
• Excessive file requests
• Port-application mismatch
• Suspicious registry or system file changes
• DNS request anomalies