← All cheat sheets

IOC ENRICHMENT

Plain-text reference · 5 KB. Read it, search it (Ctrl-F) or print it.

Indicators of Compromise (IOCs) are observable artifacts tied to malicious
activity. Enrichment adds context (reputation, age, relationships) so you can
prioritize. This sheet covers IOC types, SAFE handling, and reputable
sources -- defensive use only.

IOC TYPES#

Network   : IPv4/IPv6, domain, FQDN, URL, URI path, ASN, JA3/JA3S (TLS
            fingerprints), SSL cert SHA1/serial.
Host      : file hash (MD5/SHA1/SHA256), file name/path, mutex, named pipe,
            registry key/value, service name, scheduled-task name.
Email     : sender address, Return-Path, subject, X-Mailer, attachment hash.
Identity  : user account, API key id (never the secret), OAuth app id.
Behavioral: command lines, user-agent strings, ATT&CK technique IDs.

Pyramid of Pain (how costly each is for the adversary to change, low->high):
  hash values  <  IP addresses  <  domain names  <  network/host artifacts
  <  tools  <  TTPs. Prioritize durable indicators (TTPs) for detections,
  but hashes/IPs/domains are still useful for fast blocking and hunting.

DEFANGING (always do this before sharing/storing in tickets)#

Defanging makes an IOC non-clickable so nobody accidentally visits it.
  http://evil.com/x    ->  hxxp://evil[.]com/x
  https://bad.io       ->  hxxps://bad[.]io
  1.2.3.4              ->  1[.]2[.]3[.]4
  user@evil.com        ->  user[@]evil[.]com
Conventions: replace "." with "[.]", "http" with "hxxp", "@" with "[@]",
"://" sometimes as "[://]". "Refang" reverses it for tooling input.
CyberChef "Defang URL" / "Defang IP Address" operations automate this.

SAFE HANDLING RULES#

- NEVER paste a live malicious URL into a browser on your workstation.
- Detonate files/URLs only in an isolated sandbox or VM, never on prod.
- Upload decisions: public sandboxes (e.g. VirusTotal, urlscan public mode)
  SHARE what you submit. Do NOT upload sensitive/internal files or documents
  that may contain confidential data -- use hash lookups instead of file
  uploads for those, or a private/enterprise instance.
- Prefer HASH lookups over uploading a sample when confidentiality matters:
  searching a hash reveals nothing new about your environment.
- Record provenance: where the IOC came from, first/last seen, confidence,
  and TLP marking (TLP:CLEAR/GREEN/AMBER/RED) for sharing limits.
- Set an expiry/confidence; IOCs go stale (IPs recycle, domains expire).

REPUTABLE ENRICHMENT SOURCES & WHAT EACH IS GOOD FOR#

VirusTotal
  - File hash, URL, domain, IP reputation across many AV engines + sandbox
    behavior, relationships (files contacting a domain, etc.).
  - Hash lookup = safe; file UPLOAD = shared publicly. Mind confidentiality.

AbuseIPDB
  - Crowd-sourced IP abuse reports with a confidence score and categories
    (SSH brute force, web attack, etc.). Good for triaging source IPs.

URLhaus (abuse.ch)
  - Malware-distribution URLs/domains. Good for confirming a URL is a known
    payload host and getting the associated malware family.

ThreatFox / MalwareBazaar / Feodo Tracker (abuse.ch)
  - ThreatFox: IOC sharing (C2 IPs/domains, hashes). MalwareBazaar: malware
    samples by hash. Feodo Tracker: botnet C2 IPs (Emotet/Dridex-era).

Shodan / Censys
  - What services/banners/certs an IP or netblock exposes. Good for profiling
    an external IP or suspected C2 host's open ports and TLS certs.

WHOIS / RDAP
  - Domain registration + registrar, creation/expiry dates (domain AGE is a
    strong signal -- newly registered domains are riskier), name servers.

Passive DNS (pDNS)
  - Historical domain<->IP resolutions over time. Good for mapping
    infrastructure, finding sibling domains on a C2 IP, and fast-flux.

Certificate Transparency (crt.sh)
  - Issued TLS certs for a domain; find look-alike/cousin domains and newly
    issued certs for phishing infrastructure.

GreyNoise
  - Tells whether an IP is "internet background noise" (mass scanners) vs
    targeted. Great for de-prioritizing noisy, untargeted source IPs.

MITRE ATT&CK / threat-intel platforms (MISP, OpenCTI)
  - Map IOCs to techniques, actors, and campaigns; store with TLP and
    relationships. MISP is the common open-source sharing platform.

A PRACTICAL ENRICHMENT FLOW#

1. Normalize + defang the IOC; record source and context.
2. Classify type (IP/domain/URL/hash/...).
3. Reputation pass:
   - IP   -> AbuseIPDB + GreyNoise + Shodan/Censys + pDNS.
   - Domain -> WHOIS/RDAP age + VT + URLhaus + crt.sh + pDNS.
   - URL  -> URLhaus + VT + urlscan (public/private as appropriate).
   - Hash -> VirusTotal + MalwareBazaar.
4. Pivot: from a domain to its IPs/certs/sibling domains; from a hash to the
   domains/IPs it contacts; expand the indicator set.
5. Assign confidence + TLP; push high-confidence IOCs to blocklists/SIEM
   watchlists; keep low-confidence ones as hunt leads.
6. Set review/expiry; re-validate periodically.

CAUTIONS#

- Shared infrastructure (CDNs, cloud, parked domains) produces false
  positives -- do not block an IP that fronts many legitimate sites.
- Enrichment is context, not a verdict. Combine multiple sources.
- Blocking an active C2 can alert the adversary mid-investigation; coordinate
  with the IR plan.

Defensive reference on CyberRamen. Offensive / red-team sheets live on OffensiveRamen.com.