IOCs Are Dead -- Long Live IOCs!
summary
Explains why common Indicators of Compromise (IOCs) — often shared as simple lists of hashes and IPs — have not stopped attackers, and examines the limitations of existing IOC standards, feeds and tools. Shows how to make brittle IOCs more useful and how to leverage data already present on endpoints (endpoint telemetry) to create stronger, more actionable IOCs.
AI-written summary · about
chapters (6)
- 0:00The vision for IoCs
- 1:49Current state of threat data
- 3:55Challenges in IoC efficacy
- 6:46Improving detection strategies
- 10:06Internal hunting workflows
- 11:17Maximizing ROI and quality
related talks
22mTechnical Tracks
49mEvaluating Indicators as Composite Objects
31mAttack Hunting with Threat Intelligence
01h 05mCritical Information Infrastructure (CII) Protection: Challenges & Opportunities
30mTrawling for IOCs: Catching C2 in a Sea of Data
41m"Meet Me in the Middle: Threat Indications & Warning to enable..."
26mHow NOT to be Your Adversary's Best Friend - Doing What Matters...
37mAutomatic Extraction of Indicators of Compromise for Web App.