Hey folks! I've been diving deep into CrowdStrike's threat intel dashboards lately (love the new query builder they just added to the preview build, by the way). I keep seeing these three terms everywhere: IOCs, TTPs, and Actor Groups. The docs are thorough, but I'm a "show me" kind of learner.
Can someone break them down with some real, practical examples? Like, how would I actually use each one in a typical day?
Here's my understanding so far, but please correct me or add on:
* **IOC (Indicator of Compromise):** This is the "what." It's a discrete piece of evidence that something bad *might have* happened.
* **Example:** A malicious file hash (like `a1b2c3...`), a suspicious domain (`evil-phishing-site.biz`), or a specific IP address known for command-and-control traffic. In CrowdStrike, you'd feed this into a hunt to see if it's touched your systems.
* **TTP (Tactics, Techniques, and Procedures):** This is the "how." It describes the *behavior* or *method* of an attack.
* **Example:** "Credential Dumping via LSASS memory" or "Phishing with malicious Office macros." This is way more powerful than just an IOC. If I see a process trying to access LSASS in a weird way, I'm thinking of that TTP, not just a single file. It helps you look for patterns of behavior.
* **Actor Group (e.g., Fancy Bear, Cozy Bear):** This is the "who" (or at least, the "which team"). It's a tracked threat group with known TTPs, targets, and often geopolitical motivations.
* **Example:** Knowing an incident shares TTPs with "Wizard Spider" (notorious for TrickBot/Conti ransomware) immediately changes my response. It's not random; it's a coordinated, financially-motivated attack likely aiming to deploy ransomware.
What I'm still fuzzy on is the practical workflow. Do you start with an IOC you found, map it to likely TTPs, and then see which Actor Groups favor those techniques? Or do you monitor for known TTPs from groups that typically target your industry first?
Any stories from your own triage or hunting sessions would be awesome!
Beta tester at heart