Every digital entity leaves evidence that it existed somewhere, sometime, despite efforts to erase its traces. 

These pieces of evidence and signs could point to a deadly cyberattack with the potential to harm an organization’s reputation, steal confidential data and money, and disrupt operations. According to Cybersecurity Ventures, cybercrime costs globally can reach US$10.5 trillion by 2025. Scary, right?

So, if you want to prevent a cyberattack, you need the evidence, or indicators, to understand the security loophole and fix it before an attack can happen. 

Indicators of attack (IoAs), indicators of compromise (IoCs), and indicators of fraud are the evidence that can improve your organization’s security strategy. However, many people are confused between those different terms and their applications.

Let’s clear this confusion by understanding the differences between IoAs, IoCs, and fraud indicators and what’s best for your organization.

Indicators of attack

Indicators of attack, or IoAs, are warnings or evidence-based patterns indicating a cyberattack could be in progress or imminent. These also signify the attacker’s techniques and intentions behind the attack. 

Finding IoAs proactively and in real time is part of an organization’s security strategy to detect threats and respond to them. It aims to detect a threat before an attacker finds and exploits it to conduct a full-blown attack. 

This technique requires you to constantly collect, analyze, and understand data about your network, systems, and infrastructure while keeping yourself informed of the latest techniques of attackers to prevent cybersecurity threats.   

Characteristics of IoAs

Instead of focusing on how a cyber threat can happen, like phishing, malware, etc., the IoA strategy is more concerned with determining the “why,” the attacker’s motive early in an attack lifecycle. This enables security teams to detect and mitigate attacks proactively before any security mishap. 

But how do you determine their motive?

This requires you to analyze all the events indicating the presence of a potential attack. This analysis will reveal valuable data and attack patterns, enabling security teams to mitigate attacks early.

In case you are not familiar with what TTPs are, here’s a breakdown:

  • Tactics: The attacker’s objective and strategies used. Example: Stealing a company’s sensitive trade data by exploiting access privileges. 
  • Techniques: It means what methods attackers used to accomplish the objective. In this example, techniques could be malware,  brute force attacks, social engineering, etc. 
  • Procedures: It means how an attack happened step-by-step, detailing methods and tools used. 
periodic table of cyber attacks showcasing the different tactics, techniques and procedures used by attackers

The IoA strategy takes into account the sequence of all the events that lead to a cyberattack. For example, a cyberattack can initiate a phishing attempt to breach an organization’s IT perimeter. The attacker then moves through its network laterally to find critical vulnerabilities leading to sensitive data. They exploit these vulnerabilities to compromise systems, networks, and data.

Examples of IoAs

There are several examples of an indicator of attack, but to keep it simple, below you’ll see the most common IoAs. 

Network anomalies

You may notice unusual network traffic or data flow patterns, such as an unexpected data spike to an IP address. These indicate network infiltrations and data breaches. 

Unauthorized access attempts 

Someone trying to access your account multiple times (but you have no idea about it) clearly indicates unauthorized access attempts. 

Abnormal user behavior 

Abnormal or suspicious behavior could be logins at an odd hour, unusual access requests, unauthorized access attempts, etc. It indicates compromised accounts or insider threats. 

Unexpected changes 

Unexpected changes can happen in your files, system configurations, etc., or unknown software installations. They can indicate a cyberattack attempt. 

Server requests

Attackers can compromise a network endpoint, masking an external server’s destination to exfiltrate data to it. Malicious server requests can also happen internally after installing malware in a system. 

Other examples include:

  • Distributed denial of Service (DDoS) attacks
  • Frequent interactions between internal staff and public servers
  • Unexpected international communications
  • Using non-standard ports for connections 
  • Too many honeytoken alerts associated with a host

To detect and track IoAs, you can use real-time solutions or applications to collect, record, and analyze IoA data, detect risks, and prioritize mitigation efforts to neutralize potential attacks. 

Indicators of compromise

Indicators of compromise, or IoCs are evidence of a cyberattack, indicating that an attacker has compromised a system or network. IoCs reflect “how” an attack occurred. Specifically, IoCs reflect:

  • People, tools, and techniques associated with the cyberattack
  • Files, accounts, and data the attacker could access
  • Impacts of the attack on an organization
  • Attack severity or extent
  • Loss incurred in the incident like stolen data, compromised resources, money looted 

To find IoCs, you can gather and analyze data from your security tools like antivirus software, event logs, online services and apps, etc. 

Characteristics of IoCs

IoCs are reactive in nature, unlike proactive IoAs. This means IoCs focus on post-incident analysis to determine the signs of previous cybersecurity attacks or data breaches. This, however, doesn’t make IoCs insignificant in protecting against cyberattacks. 

Finding IoCs is one of the initial steps in your incident response strategy to measure the potential impacts of an attack and limit damages. It helps you understand if your organization is under attack, proactively prepare countermeasures, and implement your security strategies. 

Although attackers try erasing their digital footprints, you must initiate evidence hunting as early as possible to achieve better accuracy. Methods to use to find IoCs include:

Using IoC data, you can quickly patch security loopholes and secure attack surfaces to prevent similar attacks in the future. 

Examples of IoCs

Malware signatures: Viruses, trojan horses, or malware present in systems or networks indicate a security compromise.

Suspicious network traffic: Unusual network traffic or communications with unknown IPs during odd hours or from a specific/uncommon location could signify a compromise or attacks like DDoS attacks. 

IP Intelligene in One Click

  

Explore the CrowdSec Threat Intelligence and get a full report on known malicious IPs and their activity.

  Search an IP

Anomalous user activity: Abnormal or suspicious user activity, such as multiple login attempts on an account, sudden password changing requests, repeated requests to access sensitive data, etc. 

Configuration changes: Sudden, unauthorized system configuration changes, like new accounts added/deleted without permission, modified settings in privileged accounts, changed firewall settings, etc. 

Database reads: An attacker can compromise a database by gaining unauthorized access to admin accounts or SQL injections to manipulate or steal data. 

Authentication attempts: An attacker can authenticate logins through automation and stolen credentials. Frequent attempts indicate authentication failures. 

A security team must look for the above warning signs and respond immediately with a robust mitigation strategy. For example, if you detect unusual attempts to access confidential data, review your access privileges and permissions instantly. Check who has access to what resources and restrict users that violate the privileges. 

Types of IoCs

There are four main types of IoCs, primarily based on the type of environment we are looking at. 

  • File-based IoCs: Related to specific files, like file names, malicious scripts, and more. 
  • Network-based IoCs: Related to a network, such as IP addresses, URLs, domain names, etc. 
  • Behavioral IoCs: Related to how a network or system behaves at a certain point in time. Examples could be suspicious system activities, unexpected network traffic, etc. 
  • Artifact-based IoCs: Related to the traces or artifacts that an attacker has left behind. Examples could be configuration files, registry keys, etc. 

Indicators of fraud

Indicators of fraud are signs of fraudulent or deceptive activity that target individuals and organizations, especially for financial gains. These indicators could be:

The motives behind fraud vary. Attackers could be looking to gain access to confidential data like bank details, business data, personal photos, etc., or steal money, resources, or assets by accessing bank accounts or demanding ransom in exchange for sensitive data.

They could also aim to manipulate data like financial records, account credentials, etc., or gain unauthorized access to networks, systems, and apps. 

As you can imagine, identifying the indicators of fraud early is crucial to industries like the banking or insurance sector, which need to protect their customers’ bank accounts, data, and money from attackers. Indicators of fraud are also particularly important for organizations within the retail sector which operate ecommerce websites.

Improve Security for Your Ecommerce Website

  

Learn everything you need to know to defend your ecommerce store with this free and hands-on course.

  Take course

Examples of indicators of fraud

Indicators of fraud often overlap with cyber threats, such as malware and ransomware, but focus more on deceiving people for financial gains. 

For example, let’s assume an attacker has gained access to a person’s account on an ecommerce website and connects to this account from multiple locations, far from each other, in a short amount of time, making a number of purchases. Because it’s physically impossible for the real user to have logged in from, let’s say, New York at 9 AM and then from Berlin at 10 AM, given the short time frame and the vast distance between these locations, that particular user activity should raise some red flags within the system as a possible (or positive!) indicator of fraud. 

Some more examples of indicators of fraud include:

  • Unusual transaction patterns: If you spot any unusual account activities, such as multiple failed logins, frequent transactions, transferring large amounts, changed credentials, etc., it could indicate fraud. 
  • Suspicious user behavior: Sudden changes in phone numbers or email addresses, unexpected transaction requests, etc., could indicate fraud. 
  • Phishing attempts: If you receive unexpected links, email attachments, or suspicious text messages with OTPs from unknown senders, don’t engage with them! These links or attachments can download malware and expose your financial information. 
  • Fake identities or accounts: Fake accounts or identities will have something wrong with them, such as no profile picture, wrong company website URL or information, grammar and spelling mistakes, etc. It would be safe not to respond to them. 
  • Systems logs and alerts: Audit log irregularities, unauthorized modifications, etc. 
  • Suspicious finance data: Look for discrepancies like overdue invoices, vendor account information, etc.

How to detect indicators of fraud

Overall, to effectively detect indicators of fraud, you need to maintain vigilant monitoring of systems and logs. But let’s discuss in more detail some fraud detection techniques you should know. 

Anomaly detection in financial transactions

Detecting anomalies or unusual patterns in financial transactions can help identify and prevent fraud. 

Invest in a reliable anomaly detection solution to define legitimate behavior or what you consider “normal” behavior (baseline) for the collected data. Once done, let the tool compare incoming data with the set baseline and flag data deviating from the baseline. 

This fraud detection technique is mostly used to detect credit card fraud. 

Behavioral analytics

For an organization, behavior analytics involves studying the behavior of systems and users. For efficiency, modern businesses utilize behavioral analytics solutions to monitor and analyze these behaviors to detect fraud. These solutions create a list of authorized systems and user profiles and give each of them a risk score based on their behaviors. 

You can use data from behavioral analytics software to prioritize risk mitigation for critical risks first. 

Machine learning models 

Modern fraud detection solutions leverage machine learning models to predict fraudulent activities by analyzing massive data and identifying patterns. These systems study market conditions, user behavior, and transactions to detect fraud. They are continuously trained on historical and new data to provide greater accuracy in identifying fraud. 

Banks use ML models to detect insider threats, money laundering incidents, account takeovers, etc. ML models also help in real-time decision-making, such as approving/declining a financial transaction.

Comparing IoAs, IoCs, and indicators of fraud

Indicators of attack, compromise, and fraud may look similar but are different on the focus and scope, their relevant timeframe, and cybersecurity approach. Let’s cover those. 

indicators of attack vs. indicators of compromise vs. indicators of fraud

Focus and scope

Indicators of attack focus on determining the “why” behind a cyberattack or attacker’s intentions and the TTPs they use and are proactive in nature. By identifying indicators early and taking action immediately, you can secure your systems and network before any attack can happen. 

On the other hand, indicators of compromise focus on the “how” behind a cyberattack or the evidence indicating an attack. IoCs are reactive in nature, determining an attack’s severity and impact along with tools, techniques, and people associated with it. Knowing the indicators helps you counter attacks and reduce their impacts. 

Now, indicators of fraud are signs of fraud, targeting people, especially for financial gains. The motive behind fraud is to steal money, access confidential transactional data, and manipulate financial records. Detecting fraud indicators helps you implement security strategies and prevent fraud to safeguard your money from fraudsters. 

Timeframe

Security teams use IoAs in the early phases of an attack’s lifecycle to identify imminent attacks and proactively prevent them. 

IoCs, on the other hand, are generally used for post-incident analysis to understand the attack’s root cause and impacts. This helps in creating a robust security strategy and mitigating similar attacks in the future. 

Note: It is also possible to identify that a system has been compromised really early on and patch systems or block attackers before they have the chance to carry out their attack. This is why keeping a sleepless eye on those IoCs is critical for maintaining the security of your systems.

Indicators of fraud can be used before and after an attack. For example, you can use fraud indicators to make security changes and stop fraud from happening. Similarly, you can use these indicators to prepare for future attacks, ensuring the same security loopholes don’t exist in your systems or networks. 

Usage in cybersecurity strategy

IoAs, IoCs, and fraud indicators are all useful in protecting organizations and individuals against evolving cyberattacks. Although you can use any one of them in your organization’s security strategy based on your requirements, integrating all three of them will help you create a robust, comprehensive security strategy. This way, you will leverage the benefits of all three worlds.

  • Detecting the signs of cyberattacks early for proactive, real-time prevention 
  • Detecting the presence of a cyberattack to limit impacts and prepare for future attacks
  • Detecting the signs of fraud to secure your money and financial data from fraudsters

Leveraging the power of this trio is evident to combat cyberattacks becoming more powerful and advanced as we speak. It will help you enhance your organization’s security posture, keep your and your users’ data and finances safe, and maintain customer trust. 

So, do I need all of them?

If your goal is a well-rounded robust cybersecurity strategy, then yes, you do! 

When leveraged collectively, IoAs, IoCs, and indicators of fraud have the potential to enhance your organization’s security posture. So, all three of them will offer proactive, real-time protection against cyberattacks while creating future security strategies based on known security incidents. 

If you want to automate the process of detecting and mitigating attacks and fraud, use a reliable behavior-based Intrusion Detection and Prevention System (IDPS). An advanced IDPS will help you detect unknown and known threats, provide comprehensive security coverage, improve your incident response, and ultimately cut down your security operation and incident response costs. 

Behavior-Based IDPS that Works

  

Protect your systems with CrowdSec’s unique, crowd-powered and behavior-based IDPS.

  Learn more

References and further reading