TRACKING CLOUD-FLUENT THREAT ACTORS: BEHAVIORAL IOCS

Summary from the TLDR InfoSec newsletter

Behavioral IOCs attempt to enrich a traditional IOC by correlating multiple events to add context for more robust detections. This post introduces the concept of behavioral IOCs in cloud environments and provides an example of how Wiz developed IOCs for a specific threat actor. It recommends beginning with a piece of identifying information about a threat actor or tactic and then iteratively mapping out unique parameters or other identifiers to detect that threat actor to the IOC.