IOC Enrichment & Applied Threat Intelligence for SOC Analysts

Prerequisites

• COA-K001: SOC Architecture & Alert Lifecycle
• COA-K005: C2 Beaconing & DNS Exfiltration Detection

Why This Lesson Matters

An alert that says "connection to 185.220.101.5" is nearly useless alone. An alert that says "connection to 185.220.101.5 — known Cobalt Strike C2, 45 AbuseIPDB reports in 30 days, registered 2026-05-02, hosting malware family TrickBot" is immediately actionable. IOC enrichment converts raw indicators into intelligence.

1. IOC Types and Sources

1.1 Indicator Taxonomy

The Pyramid of Pain (David Bianco): higher-level IOCs (TTPs) are harder for attackers to change than low-level ones (hashes, IPs). Prioritise sharing and detecting TTPs over hashes.

1.2 Primary Enrichment Sources

2. The Enrichment Workflow

2.1 Step-by-Step for an IP Alert

Alert: host 10.0.0.42 connected to 203.0.113.55:8080

Step 1 — VirusTotal
  Search: 203.0.113.55
  Result: 23/90 engines flag as malicious
  Tags: "botnet", "C2", "TrickBot"
  Last seen: 2026-06-07 (yesterday)

Step 2 — AbuseIPDB
  Search: 203.0.113.55
  Confidence score: 87%
  Category: C2, port scanning
  37 reports in last 30 days

Step 3 — Shodan
  203.0.113.55: open ports 80, 443, 8080, 8443
  Banner on 8080: Apache 2.4 (generic — common for C2)
  ASN: AS24940 (Hetzner Online GmbH — VPS hosting)
  Country: DE

Step 4 — Passive DNS (VirusTotal "Relations" tab)
  203.0.113.55 resolved to: system-update-cdn.com (registered 2026-05-28)
  Neighbouring IPs: cluster of 10 IPs with similar hosting patterns

Step 5 — ThreatFox
  203.0.113.55 associated with: TrickBot C2, confidence high

Decision: Confirmed C2 infrastructure. Escalate to P1. Block IP and related domain.
          Hunt for other 10.x hosts connecting to AS24940.

2.2 Step-by-Step for a Hash Alert

Alert: EDR flagged new executable hash a3f9b2c1...

Step 1 — VirusTotal
  Hash: a3f9b2c1...
  Detection: 41/90 (High)
  Family: CobaltStrike (Beacon)
  First submission: 2026-06-01
  File type: PE32 executable

Step 2 — Malware Bazaar
  Hash found
  Family: CobaltStrike
  Tags: cs-beacon, loader

Step 3 — VirusTotal "Behavior" tab
  Sandbox run shows:
  - Creates scheduled task for persistence
  - Connects to 203.0.113.55:8080 (already known C2!)
  - Drops C:UsersPublicupdater.exe

Step 4 — Correlate
  C2 IP from sandbox = C2 IP from network alert → same infrastructure
  Pivot: hunt for the dropped file hash in EDR telemetry

Decision: Malicious. Confirmed TrickBot loader. Initiate full IR process.

3. Paste Site Monitoring

Threat actors and data brokers post leaked credentials, source code, and company data to paste sites (Pastebin, GitHub Gist, Ghostbin, etc.). SOC teams monitor these for: - Credentials for company email domains - Source code snippets that hint at insider threats - Infrastructure data (API keys, connection strings)

3.1 Manual Paste Investigation

1. Browse paste index or use search: site:pastebin.com "@company.com"
2. Identify relevant pastes by content type
3. Extract indicators (email addresses, credentials, API keys)
4. Cross-reference against internal user directory
5. If company credentials found → password reset for affected accounts
   + notify IT + consider incident notification obligations

3.2 Recognising Leaked Credential Formats

4. Structuring IOCs for Sharing

Professional IOC sharing uses structured formats:

4.1 STIX 2.1 Indicator (simplified JSON)

{
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--a3b4c5d6...",
  "created": "2026-06-08T14:32:00Z",
  "modified": "2026-06-08T14:32:00Z",
  "name": "TrickBot C2 IP",
  "indicator_types": ["malicious-activity"],
  "pattern": "[ipv4-addr:value = '203.0.113.55']",
  "pattern_type": "stix",
  "valid_from": "2026-06-08T14:32:00Z",
  "confidence": 85,
  "labels": ["C2", "TrickBot"],
  "kill_chain_phases": [{
    "kill_chain_name": "mitre-attack",
    "phase_name": "command-and-control"
  }]
}

For most analysts, writing full STIX is not required — that is a CTI analyst task. However, understanding the structure helps when consuming threat feeds in MISP or OpenCTI.

5. Common Mistakes

Mistake 1: Treating VirusTotal 0/90 as clean. A brand-new C2 domain registered yesterday will have 0 detections. Check: registration date, hosting ASN, certificate history, passive DNS, and whether the domain name follows common C2 naming patterns.

Mistake 2: Blocking a paste-leaked credential without investigating scope. One leaked credential paste may indicate a broader database breach. Check whether other company credentials are in the paste or in associated dumps via HaveIBeenPwned or internal search.

Mistake 3: Enriching without documenting. Enrichment that is not written down is enrichment that cannot be shared, reviewed, or acted on systematically. Always write the enrichment output into the ticket before closing or escalating.

6. Practice Exercises

1. Look up IP 45.33.32.156 (Scanme.nmap.org — public test host) in Shodan and AbuseIPDB. What open ports does Shodan report? How many AbuseIPDB reports in the last 30 days?

2. A SIEM alert shows a connection to pastebin.com from a corporate host. The analyst notes this is a common site and closes the alert. What enrichment should have been performed before closing?

3. You receive this credential dump from a paste site: [email protected]:Password123 [email protected]:Summer2026! [email protected]:Monkey1 List your immediate actions in order.

7. Lab

Assessment mode: flag

challenge_spec_id: 224 — Pastebin credential leak

A simulated paste site contains public pastes. One paste contains a leaked credential dump related to a target organisation.

Task: 1. Browse the paste index 2. Identify the paste containing company credentials 3. Extract the value of the SECRET_KEY field embedded in the paste 4. The SECRET_KEY value is the flag in PREFIX{...} format

8. Framework Alignment

9. Further Reading

• VirusTotal API — https://developers.virustotal.com — Automate enrichment in SOAR
• AbuseIPDB API — https://docs.abuseipdb.com — Batch IP reputation checks
• OpenCTI — https://opencti.io — Open-source CTI platform for structured IOC management
• Have I Been Pwned — https://haveibeenpwned.com — Credential breach notifications
• STIX 2.1 Specification — https://oasis-open.github.io/cti-documentation/

["Apply the five-step IOC enrichment workflow to a suspected C2 IP address using VirusTotal, AbuseIPDB, and Shodan, and produce a written enrichment summary that supports an escalation decision", "Identify six credential and secret patterns (AWS key, JWT, GitHub token, private key, credential dump, API key) in a text extract", "Browse a simulated paste site index, identify a credential-bearing paste, and extract a specific secret key value from its contents"]

Prerequisites → Why this matters → IOC taxonomy (types and volatility, Pyramid of Pain) → Primary enrichment sources (table) → Enrichment workflow: IP alert (5-step) + hash alert (4-step) → Paste site monitoring (manual investigation, format recognition) → Structuring IOCs for sharing (STIX 2.1 preview) → Common mistakes → Practice exercises → Lab (flag, spec 224) → Framework alignment → Further reading