{"id":477571,"date":"2023-08-09T09:16:45","date_gmt":"2023-08-09T09:16:45","guid":{"rendered":""},"modified":"2023-09-05T11:14:59","modified_gmt":"2023-09-05T11:14:59","slug":"indicator-of-compromise","status":"publish","type":"wiki","link":"https:\/\/oneproxy.pro\/vn\/wiki\/indicator-of-compromise\/","title":{"rendered":"Ch\u1ec9 s\u1ed1 th\u1ecfa hi\u1ec7p"},"content":{"rendered":"<p>Ch\u1ec9 s\u1ed1 th\u1ecfa hi\u1ec7p (IoC) l\u00e0 nh\u1eefng ph\u1ea7n d\u1eef li\u1ec7u \u0111i\u1ec1u tra x\u00e1c \u0111\u1ecbnh c\u00e1c ho\u1ea1t \u0111\u1ed9ng \u0111\u1ed9c h\u1ea1i ti\u1ec1m \u1ea9n tr\u00ean m\u1ea1ng. Nh\u1eefng t\u1ea1o ph\u1ea9m n\u00e0y \u0111\u01b0\u1ee3c c\u00e1c chuy\u00ean gia an ninh m\u1ea1ng s\u1eed d\u1ee5ng \u0111\u1ec3 ph\u00e1t hi\u1ec7n c\u00e1c vi ph\u1ea1m d\u1eef li\u1ec7u, l\u00e2y nhi\u1ec5m ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i v\u00e0 c\u00e1c m\u1ed1i \u0111e d\u1ecda kh\u00e1c. Vi\u1ec7c \u00e1p d\u1ee5ng IoC n\u00e2ng cao t\u00ecnh tr\u1ea1ng b\u1ea3o m\u1eadt c\u1ee7a m\u1ea1ng, bao g\u1ed3m c\u1ea3 nh\u1eefng m\u1ea1ng s\u1eed d\u1ee5ng m\u00e1y ch\u1ee7 proxy nh\u01b0 m\u00e1y ch\u1ee7 do OneProxy cung c\u1ea5p.<\/p>\n<h2>Ngu\u1ed3n g\u1ed1c v\u00e0 b\u1ed1i c\u1ea3nh l\u1ecbch s\u1eed c\u1ee7a ch\u1ec9 s\u1ed1 th\u1ecfa hi\u1ec7p<\/h2>\n<p>Kh\u00e1i ni\u1ec7m Ch\u1ec9 s\u1ed1 th\u1ecfa hi\u1ec7p \u0111\u01b0\u1ee3c h\u00ecnh th\u00e0nh nh\u01b0 m\u1ed9t ph\u1ea3n \u1ee9ng tr\u01b0\u1edbc nhu c\u1ea7u v\u1ec1 c\u00e1c bi\u1ec7n ph\u00e1p ch\u1ee7 \u0111\u1ed9ng trong an ninh m\u1ea1ng. Thu\u1eadt ng\u1eef n\u00e0y l\u1ea7n \u0111\u1ea7u ti\u00ean \u0111\u01b0\u1ee3c Mandiant (m\u1ed9t c\u00f4ng ty an ninh m\u1ea1ng) gi\u1edbi thi\u1ec7u trong b\u00e1o c\u00e1o n\u0103m 2013 v\u1ec1 C\u00e1c m\u1ed1i \u0111e d\u1ecda li\u00ean t\u1ee5c n\u00e2ng cao (APT). B\u00e1o c\u00e1o \u0111\u00e3 ph\u00e1c th\u1ea3o c\u00e1ch ti\u1ebfp c\u1eadn \u0111\u1ec3 x\u00e1c \u0111\u1ecbnh c\u00e1c ho\u1ea1t \u0111\u1ed9ng \u0111\u00e1ng ng\u1edd trong h\u1ec7 th\u1ed1ng b\u1eb1ng c\u00e1ch s\u1eed d\u1ee5ng c\u00e1c ch\u1ec9 b\u00e1o v\u00e0 do \u0111\u00f3 \u0111\u00e1nh d\u1ea5u s\u1ef1 kh\u1edfi \u0111\u1ea7u c\u1ee7a IoC trong b\u1ed1i c\u1ea3nh an ninh m\u1ea1ng.<\/p>\n<h2>D\u1ea5u hi\u1ec7u c\u1ee7a s\u1ef1 th\u1ecfa hi\u1ec7p: S\u1ef1 hi\u1ec3u bi\u1ebft s\u00e2u s\u1eafc h\u01a1n<\/h2>\n<p>IoC gi\u1ed1ng nh\u01b0 m\u1ed9t manh m\u1ed1i g\u1ee3i \u00fd v\u1ec1 s\u1ef1 x\u00e2m nh\u1eadp ho\u1eb7c nguy c\u01a1 b\u1ecb x\u00e2m ph\u1ea1m trong m\u1ea1ng. N\u00f3 c\u00f3 th\u1ec3 bao g\u1ed3m t\u1eeb d\u1eef li\u1ec7u \u0111\u01a1n gi\u1ea3n nh\u01b0 \u0111\u1ecba ch\u1ec9 IP, URL v\u00e0 t\u00ean mi\u1ec1n \u0111\u1ebfn c\u00e1c m\u1eabu ph\u1ee9c t\u1ea1p h\u01a1n nh\u01b0 b\u0103m t\u1ec7p ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i, m\u1eabu t\u1eadp l\u1ec7nh \u0111\u1ed9c h\u1ea1i ho\u1eb7c th\u1eadm ch\u00ed c\u1ea3 chi\u1ebfn thu\u1eadt, k\u1ef9 thu\u1eadt v\u00e0 quy tr\u00ecnh (TTP) c\u1ee7a c\u00e1c t\u00e1c nh\u00e2n \u0111e d\u1ecda.<\/p>\n<p>Khi nh\u1eefng b\u1eb1ng ch\u1ee9ng n\u00e0y \u0111\u01b0\u1ee3c ph\u00e1t hi\u1ec7n trong m\u1ea1ng, ch\u00fang cho th\u1ea5y kh\u1ea3 n\u0103ng cao x\u1ea3y ra s\u1ef1 x\u00e2m ph\u1ea1m b\u1ea3o m\u1eadt. Ch\u00fang \u0111\u01b0\u1ee3c thu th\u1eadp t\u1eeb nhi\u1ec1u ngu\u1ed3n kh\u00e1c nhau nh\u01b0 nh\u1eadt k\u00fd, g\u00f3i, d\u1eef li\u1ec7u lu\u1ed3ng v\u00e0 c\u1ea3nh b\u00e1o, \u0111\u1ed3ng th\u1eddi \u0111\u01b0\u1ee3c c\u00e1c nh\u00f3m b\u1ea3o m\u1eadt s\u1eed d\u1ee5ng \u0111\u1ec3 ph\u00e1t hi\u1ec7n, ng\u0103n ch\u1eb7n v\u00e0 gi\u1ea3m thi\u1ec3u c\u00e1c m\u1ed1i \u0111e d\u1ecda.<\/p>\n<h2>Ho\u1ea1t \u0111\u1ed9ng b\u00ean trong c\u1ee7a ch\u1ec9 s\u1ed1 th\u1ecfa hi\u1ec7p<\/h2>\n<p>C\u00e1c ch\u1ec9 s\u1ed1 v\u1ec1 Th\u1ecfa hi\u1ec7p ho\u1ea1t \u0111\u1ed9ng d\u1ef1a tr\u00ean th\u00f4ng tin v\u1ec1 m\u1ed1i \u0111e d\u1ecda. C\u00e1c c\u00f4ng c\u1ee5 an ninh m\u1ea1ng thu th\u1eadp d\u1eef li\u1ec7u, ph\u00e2n t\u00edch v\u00e0 so s\u00e1nh d\u1eef li\u1ec7u v\u1edbi c\u00e1c IoC \u0111\u00e3 bi\u1ebft. N\u1ebfu t\u00ecm th\u1ea5y k\u1ebft qu\u1ea3 tr\u00f9ng kh\u1edbp, \u0111i\u1ec1u \u0111\u00f3 cho th\u1ea5y s\u1ef1 hi\u1ec7n di\u1ec7n c\u1ee7a m\u1ed1i \u0111e d\u1ecda ho\u1eb7c vi ph\u1ea1m an ninh.<\/p>\n<p>IoC ho\u1ea1t \u0111\u1ed9ng th\u00f4ng qua c\u00e1c b\u01b0\u1edbc sau:<\/p>\n<ol>\n<li>\n<p>Thu th\u1eadp d\u1eef li\u1ec7u: D\u1eef li\u1ec7u t\u1eeb nh\u1eadt k\u00fd, g\u00f3i m\u1ea1ng, ho\u1ea1t \u0111\u1ed9ng c\u1ee7a ng\u01b0\u1eddi d\u00f9ng v\u00e0 c\u00e1c ngu\u1ed3n kh\u00e1c \u0111\u01b0\u1ee3c thu th\u1eadp.<\/p>\n<\/li>\n<li>\n<p>Ph\u00e2n t\u00edch: D\u1eef li\u1ec7u thu th\u1eadp \u0111\u01b0\u1ee3c s\u1ebd \u0111\u01b0\u1ee3c ph\u00e2n t\u00edch \u0111\u1ec3 ph\u00e1t hi\u1ec7n m\u1ecdi ho\u1ea1t \u0111\u1ed9ng \u0111\u00e1ng ng\u1edd ho\u1eb7c s\u1ef1 b\u1ea5t th\u01b0\u1eddng.<\/p>\n<\/li>\n<li>\n<p>So kh\u1edbp IoC: D\u1eef li\u1ec7u \u0111\u01b0\u1ee3c ph\u00e2n t\u00edch \u0111\u01b0\u1ee3c so kh\u1edbp v\u1edbi c\u00e1c IoC \u0111\u00e3 bi\u1ebft t\u1eeb nhi\u1ec1u ngu\u1ed3n th\u00f4ng tin v\u1ec1 m\u1ed1i \u0111e d\u1ecda kh\u00e1c nhau.<\/p>\n<\/li>\n<li>\n<p>C\u1ea3nh b\u00e1o: N\u1ebfu t\u00ecm th\u1ea5y k\u1ebft qu\u1ea3 tr\u00f9ng kh\u1edbp, c\u1ea3nh b\u00e1o s\u1ebd \u0111\u01b0\u1ee3c t\u1ea1o \u0111\u1ec3 th\u00f4ng b\u00e1o cho nh\u00f3m b\u1ea3o m\u1eadt v\u1ec1 m\u1ed1i \u0111e d\u1ecda ti\u1ec1m \u1ea9n.<\/p>\n<\/li>\n<li>\n<p>\u0110i\u1ec1u tra: Nh\u00f3m b\u1ea3o m\u1eadt \u0111i\u1ec1u tra c\u1ea3nh b\u00e1o \u0111\u1ec3 x\u00e1c nh\u1eadn v\u00e0 hi\u1ec3u b\u1ea3n ch\u1ea5t c\u1ee7a m\u1ed1i \u0111e d\u1ecda.<\/p>\n<\/li>\n<li>\n<p>Gi\u1ea3m thi\u1ec3u: C\u00e1c bi\u1ec7n ph\u00e1p \u0111\u01b0\u1ee3c th\u1ef1c hi\u1ec7n \u0111\u1ec3 lo\u1ea1i b\u1ecf m\u1ed1i \u0111e d\u1ecda v\u00e0 ph\u1ee5c h\u1ed3i sau m\u1ecdi thi\u1ec7t h\u1ea1i.<\/p>\n<\/li>\n<\/ol>\n<h2>C\u00e1c \u0111\u1eb7c \u0111i\u1ec3m ch\u00ednh c\u1ee7a Ch\u1ec9 b\u00e1o Th\u1ecfa hi\u1ec7p<\/h2>\n<ul>\n<li>\n<p>Ph\u00e1t hi\u1ec7n c\u00e1c m\u1ed1i \u0111e d\u1ecda n\u00e2ng cao: IoC c\u00f3 th\u1ec3 x\u00e1c \u0111\u1ecbnh c\u00e1c m\u1ed1i \u0111e d\u1ecda tinh vi m\u00e0 c\u00e1c bi\u1ec7n ph\u00e1p b\u1ea3o v\u1ec7 an ninh truy\u1ec1n th\u1ed1ng c\u00f3 th\u1ec3 b\u1ecf s\u00f3t.<\/p>\n<\/li>\n<li>\n<p>B\u1ea3o m\u1eadt ch\u1ee7 \u0111\u1ed9ng: IoC cung c\u1ea5p c\u00e1ch ti\u1ebfp c\u1eadn ch\u1ee7 \u0111\u1ed9ng v\u1ec1 b\u1ea3o m\u1eadt b\u1eb1ng c\u00e1ch x\u00e1c \u0111\u1ecbnh s\u1edbm c\u00e1c m\u1ed1i \u0111e d\u1ecda trong v\u00f2ng \u0111\u1eddi c\u1ee7a ch\u00fang.<\/p>\n<\/li>\n<li>\n<p>Th\u00f4ng tin theo ng\u1eef c\u1ea3nh: IoC cung c\u1ea5p b\u1ed1i c\u1ea3nh c\u00f3 gi\u00e1 tr\u1ecb v\u1ec1 c\u00e1c m\u1ed1i \u0111e d\u1ecda, ch\u1eb3ng h\u1ea1n nh\u01b0 c\u00e1c t\u00e1c nh\u00e2n \u0111e d\u1ecda li\u00ean quan, k\u1ef9 thu\u1eadt v\u00e0 m\u1ee5c ti\u00eau c\u1ee7a ch\u00fang.<\/p>\n<\/li>\n<li>\n<p>T\u00edch h\u1ee3p v\u1edbi c\u00e1c c\u00f4ng c\u1ee5 b\u1ea3o m\u1eadt: IoC c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c t\u00edch h\u1ee3p v\u1edbi nhi\u1ec1u c\u00f4ng c\u1ee5 b\u1ea3o m\u1eadt kh\u00e1c nhau nh\u01b0 SIEM, t\u01b0\u1eddng l\u1eeda v\u00e0 IDS\/IPS \u0111\u1ec3 ph\u00e1t hi\u1ec7n m\u1ed1i \u0111e d\u1ecda theo th\u1eddi gian th\u1ef1c.<\/p>\n<\/li>\n<li>\n<p>Th\u00f4ng tin v\u1ec1 m\u1ed1i \u0111e d\u1ecda: IoC \u0111\u00f3ng g\u00f3p v\u00e0o th\u00f4ng tin v\u1ec1 m\u1ed1i \u0111e d\u1ecda b\u1eb1ng c\u00e1ch cung c\u1ea5p th\u00f4ng tin chi ti\u1ebft v\u1ec1 b\u1ed1i c\u1ea3nh m\u1ed1i \u0111e d\u1ecda \u0111ang ph\u00e1t tri\u1ec3n.<\/p>\n<\/li>\n<\/ul>\n<h2>C\u00e1c lo\u1ea1i ch\u1ec9 s\u1ed1 th\u1ecfa hi\u1ec7p<\/h2>\n<p>C\u00f3 nhi\u1ec1u lo\u1ea1i IoC kh\u00e1c nhau d\u1ef1a tr\u00ean lo\u1ea1i b\u1eb1ng ch\u1ee9ng m\u00e0 ch\u00fang \u0111\u01b0a ra:<\/p>\n<ol>\n<li>\n<p><strong>C\u00e1c ch\u1ec9 s\u1ed1 m\u1ea1ng:<\/strong><\/p>\n<ul>\n<li>C\u00e1c \u0111\u1ecba ch\u1ec9 IP<\/li>\n<li>T\u00ean mi\u1ec1n<\/li>\n<li>URL\/URI<\/li>\n<li>T\u00e1c nh\u00e2n ng\u01b0\u1eddi d\u00f9ng HTTP<\/li>\n<li>Ch\u1ec9 b\u00e1o t\u00ean m\u00e1y ch\u1ee7 (SNI)<\/li>\n<li>Giao th\u1ee9c m\u1ea1ng<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong>Ch\u1ec9 s\u1ed1 m\u00e1y ch\u1ee7:<\/strong><\/p>\n<ul>\n<li>B\u0103m t\u1ec7p (MD5, SHA1, SHA256)<\/li>\n<li>\u0110\u01b0\u1eddng d\u1eabn t\u1ec7p<\/li>\n<li>Kh\u00f3a \u0111\u0103ng k\u00fd<\/li>\n<li>T\u00ean Mutex (\u0110\u1ed9t bi\u1ebfn)<\/li>\n<li>\u1ed0ng \u0111\u01b0\u1ee3c \u0111\u1eb7t t\u00ean<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong>C\u00e1c ch\u1ec9 s\u1ed1 h\u00e0nh vi:<\/strong><\/p>\n<ul>\n<li>C\u00e1c m\u1eabu t\u1eadp l\u1ec7nh \u0111\u1ed9c h\u1ea1i<\/li>\n<li>Quy tr\u00ecnh b\u1ea5t th\u01b0\u1eddng<\/li>\n<li>Chi\u1ebfn thu\u1eadt, k\u1ef9 thu\u1eadt v\u00e0 quy tr\u00ecnh (TTP)<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<h2>S\u1eed d\u1ee5ng Ch\u1ec9 s\u1ed1 Th\u1ecfa hi\u1ec7p: Th\u00e1ch th\u1ee9c v\u00e0 Gi\u1ea3i ph\u00e1p<\/h2>\n<p>Vi\u1ec7c s\u1eed d\u1ee5ng IoC kh\u00f4ng ph\u1ea3i l\u00e0 kh\u00f4ng c\u00f3 th\u00e1ch th\u1ee9c. Th\u00f4ng tin sai l\u1ec7ch, IoC l\u1ed7i th\u1eddi v\u00e0 thi\u1ebfu th\u00f4ng tin theo ng\u1eef c\u1ea3nh c\u00f3 th\u1ec3 c\u1ea3n tr\u1edf t\u00ednh hi\u1ec7u qu\u1ea3 c\u1ee7a IoC.<\/p>\n<p>Tuy nhi\u00ean, nh\u1eefng v\u1ea5n \u0111\u1ec1 n\u00e0y c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c gi\u1ea3i quy\u1ebft b\u1eb1ng c\u00e1ch:<\/p>\n<ul>\n<li>S\u1eed d\u1ee5ng ngu\u1ed3n c\u1ea5p d\u1eef li\u1ec7u th\u00f4ng minh v\u1ec1 m\u1ed1i \u0111e d\u1ecda \u0111\u01b0\u1ee3c c\u1eadp nh\u1eadt, ch\u1ea5t l\u01b0\u1ee3ng cao \u0111\u1ec3 gi\u1ea3m nguy c\u01a1 x\u1ea3y ra k\u1ebft qu\u1ea3 d\u01b0\u01a1ng t\u00ednh gi\u1ea3 v\u00e0 IoC l\u1ed7i th\u1eddi.<\/li>\n<li>S\u1eed d\u1ee5ng c\u00e1c c\u00f4ng c\u1ee5 cung c\u1ea5p b\u1ed1i c\u1ea3nh phong ph\u00fa cho IoC \u0111\u1ec3 hi\u1ec3u r\u00f5 h\u01a1n v\u1ec1 b\u1ea3n ch\u1ea5t c\u1ee7a c\u00e1c m\u1ed1i \u0111e d\u1ecda.<\/li>\n<li>Th\u01b0\u1eddng xuy\u00ean \u0111i\u1ec1u ch\u1ec9nh v\u00e0 c\u1eadp nh\u1eadt c\u00e1c c\u00f4ng c\u1ee5 v\u00e0 ph\u01b0\u01a1ng ph\u00e1p ph\u00f9 h\u1ee3p v\u1edbi IoC.<\/li>\n<\/ul>\n<h2>So s\u00e1nh c\u00e1c ch\u1ec9 s\u1ed1 th\u1ecfa hi\u1ec7p v\u1edbi c\u00e1c \u0111i\u1ec1u kho\u1ea3n t\u01b0\u01a1ng t\u1ef1<\/h2>\n<table>\n<thead>\n<tr>\n<th>Thu\u1eadt ng\u1eef<\/th>\n<th>S\u1ef1 mi\u00eau t\u1ea3<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Ch\u1ec9 b\u00e1o v\u1ec1 s\u1ef1 th\u1ecfa hi\u1ec7p (IoC)<\/td>\n<td>Ph\u1ea7n d\u1eef li\u1ec7u x\u00e1c \u0111\u1ecbnh ho\u1ea1t \u0111\u1ed9ng \u0111\u1ed9c h\u1ea1i ti\u1ec1m \u1ea9n.<\/td>\n<\/tr>\n<tr>\n<td>Ch\u1ec9 b\u00e1o t\u1ea5n c\u00f4ng (IoA)<\/td>\n<td>B\u1eb1ng ch\u1ee9ng cho th\u1ea5y m\u1ed9t cu\u1ed9c t\u1ea5n c\u00f4ng \u0111ang di\u1ec5n ra ho\u1eb7c s\u1eafp x\u1ea3y ra.<\/td>\n<\/tr>\n<tr>\n<td>Ch\u1ec9 b\u00e1o m\u1ed1i \u0111e d\u1ecda<\/td>\n<td>Thu\u1eadt ng\u1eef chung cho IoC ho\u1eb7c IoA cho bi\u1ebft c\u00e1c m\u1ed1i \u0111e d\u1ecda ti\u1ec1m \u1ea9n ho\u1eb7c th\u1ef1c t\u1ebf.<\/td>\n<\/tr>\n<tr>\n<td>Chi\u1ebfn thu\u1eadt, k\u1ef9 thu\u1eadt v\u00e0 th\u1ee7 t\u1ee5c (TTP)<\/td>\n<td>M\u00f4 t\u1ea3 c\u00e1ch c\u00e1c t\u00e1c nh\u00e2n \u0111e d\u1ecda ho\u1ea1t \u0111\u1ed9ng v\u00e0 nh\u1eefng g\u00ec ch\u00fang c\u00f3 th\u1ec3 l\u00e0m ti\u1ebfp theo.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>Quan \u0111i\u1ec3m t\u01b0\u01a1ng lai v\u00e0 c\u00f4ng ngh\u1ec7 li\u00ean quan \u0111\u1ebfn ch\u1ec9 s\u1ed1 th\u1ecfa hi\u1ec7p<\/h2>\n<p>T\u01b0\u01a1ng lai c\u1ee7a IoC n\u1eb1m \u1edf s\u1ef1 t\u00edch h\u1ee3p v\u1edbi c\u00e1c c\u00f4ng ngh\u1ec7 ti\u00ean ti\u1ebfn nh\u01b0 h\u1ecdc m\u00e1y v\u00e0 tr\u00ed tu\u1ec7 nh\u00e2n t\u1ea1o. Nh\u1eefng c\u00f4ng ngh\u1ec7 n\u00e0y c\u00f3 th\u1ec3 t\u1ef1 \u0111\u1ed9ng h\u00f3a vi\u1ec7c thu th\u1eadp v\u00e0 ph\u00e2n t\u00edch d\u1eef li\u1ec7u, \u0111\u1ed3ng th\u1eddi n\u00e2ng cao kh\u1ea3 n\u0103ng ph\u00e1t hi\u1ec7n b\u1eb1ng c\u00e1ch h\u1ecdc h\u1ecfi t\u1eeb c\u00e1c m\u1eabu trong d\u1eef li\u1ec7u. H\u01a1n n\u1eefa, vi\u1ec7c s\u1eed d\u1ee5ng c\u00f4ng ngh\u1ec7 blockchain c\u00f3 kh\u1ea3 n\u0103ng c\u1ea3i thi\u1ec7n \u0111\u1ed9 tin c\u1eady v\u00e0 t\u00ednh b\u1ea5t bi\u1ebfn c\u1ee7a d\u1eef li\u1ec7u t\u00ecnh b\u00e1o v\u1ec1 m\u1ed1i \u0111e d\u1ecda.<\/p>\n<h2>M\u00e1y ch\u1ee7 proxy v\u00e0 ch\u1ec9 b\u00e1o th\u1ecfa hi\u1ec7p<\/h2>\n<p>C\u00e1c m\u00e1y ch\u1ee7 proxy, ch\u1eb3ng h\u1ea1n nh\u01b0 c\u00e1c m\u00e1y ch\u1ee7 do OneProxy cung c\u1ea5p, c\u00f3 th\u1ec3 t\u01b0\u01a1ng t\u00e1c \u0111\u00e1ng k\u1ec3 v\u1edbi IoC. Proxy cung c\u1ea5p m\u1ed9t l\u1edbp tr\u1eebu t\u01b0\u1ee3ng v\u00e0 b\u1ea3o m\u1eadt gi\u1eefa ng\u01b0\u1eddi d\u00f9ng v\u00e0 internet. D\u1eef li\u1ec7u \u0111i qua m\u00e1y ch\u1ee7 proxy c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c ki\u1ec3m tra IoC, khi\u1ebfn ch\u00fang tr\u1edf th\u00e0nh \u0111i\u1ec3m c\u00f3 gi\u00e1 tr\u1ecb \u0111\u1ec3 ph\u00e1t hi\u1ec7n v\u00e0 gi\u1ea3m thi\u1ec3u c\u00e1c m\u1ed1i \u0111e d\u1ecda. H\u01a1n n\u1eefa, proxy c\u0169ng c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng \u0111\u1ec3 \u1ea9n danh ngu\u1ed3n c\u1ee7a IoC, khi\u1ebfn c\u00e1c t\u00e1c nh\u00e2n \u0111e d\u1ecda g\u1eb7p kh\u00f3 kh\u0103n h\u01a1n trong vi\u1ec7c x\u00e1c \u0111\u1ecbnh m\u1ee5c ti\u00eau c\u1ee7a ch\u00fang.<\/p>\n<h2>Li\u00ean k\u1ebft li\u00ean quan<\/h2>\n<ol>\n<li><a href=\"https:\/\/attack.mitre.org\/\" target=\"_new\" rel=\"noopener nofollow\">Khung MITER ATT&amp;CK<\/a><\/li>\n<li><a href=\"http:\/\/openioc.org\/\" target=\"_new\" rel=\"noopener nofollow\">Khung OpenIOC<\/a><\/li>\n<li><a href=\"https:\/\/oasis-open.github.io\/cti-documentation\/\" target=\"_new\" rel=\"noopener nofollow\">Th\u00f4ng tin v\u1ec1 m\u1ed1i \u0111e d\u1ecda m\u1ea1ng STIX\/TAXII<\/a><\/li>\n<li><a href=\"https:\/\/www.sans.org\/reading-room\/whitepapers\/forensics\/paper\/33949\" target=\"_new\" rel=\"noopener nofollow\">C\u00e1c ch\u1ec9 s\u1ed1 th\u1ecfa hi\u1ec7p (IoC) \u2013 Vi\u1ec7n SANS<\/a><\/li>\n<\/ol>\n<p>C\u00e1c ch\u1ec9 s\u1ed1 v\u1ec1 Th\u1ecfa hi\u1ec7p cung c\u1ea5p nh\u1eefng hi\u1ec3u bi\u1ebft quan tr\u1ecdng v\u1ec1 c\u00e1c m\u1ed1i \u0111e d\u1ecda ti\u1ec1m \u1ea9n ho\u1eb7c hi\u1ec7n c\u00f3. M\u1eb7c d\u00f9 ch\u00fang \u0111\u01b0a ra nh\u1eefng th\u00e1ch th\u1ee9c nh\u01b0ng nh\u1eefng l\u1ee3i \u00edch m\u00e0 ch\u00fang mang l\u1ea1i v\u1ec1 m\u1eb7t ph\u00e1t hi\u1ec7n v\u00e0 gi\u1ea3m thi\u1ec3u m\u1ed1i \u0111e d\u1ecda ch\u1ee7 \u0111\u1ed9ng l\u00e0 r\u1ea5t \u0111\u00e1ng k\u1ec3. V\u1edbi vi\u1ec7c t\u00edch h\u1ee3p c\u00e1c c\u00f4ng ngh\u1ec7 ti\u00ean ti\u1ebfn, IoC s\u1ebd ti\u1ebfp t\u1ee5c l\u00e0 m\u1ed9t ph\u1ea7n quan tr\u1ecdng trong chi\u1ebfn l\u01b0\u1ee3c an ninh m\u1ea1ng.<\/p>","protected":false},"featured_media":477572,"menu_order":0,"template":"","meta":{"_acf_changed":false,"content-type":"","inline_featured_image":false,"footnotes":""},"class_list":["post-477571","wiki","type-wiki","status-publish","has-post-thumbnail","hentry"],"acf":{"faq_title":"Frequently Asked Questions about <mark>Indicator of Compromise: An Essential Tool for Cybersecurity<\/mark>","faq_items":[{"question":"What is an Indicator of Compromise (IoC)?","answer":"<p>An Indicator of Compromise (IoC) is a piece of forensic data that cybersecurity professionals use to identify potentially malicious activities on a network. IoCs can range from simple data like IP addresses, URLs, and domain names to more complex patterns such as hashes of malware files or patterns of malicious scripts.<\/p>"},{"question":"Who introduced the concept of Indicator of Compromise?","answer":"<p>The concept of Indicator of Compromise was first introduced by Mandiant, a cybersecurity firm, in its 2013 report on Advanced Persistent Threats (APTs).<\/p>"},{"question":"How does an Indicator of Compromise work?","answer":"<p>An IoC works by collecting data from various sources like logs, packets, and alerts. This data is then analyzed and compared against known IoCs from various threat intelligence sources. If a match is found, an alert is generated to inform the security team of a potential threat, who then investigates and takes measures to mitigate the threat.<\/p>"},{"question":"What are the key features of an Indicator of Compromise?","answer":"<p>Key features of IoCs include their ability to detect advanced threats that traditional security defenses might miss, their proactive approach to security, the provision of valuable contextual information about threats, their integration with various security tools, and their contribution to threat intelligence.<\/p>"},{"question":"What are the different types of Indicator of Compromise?","answer":"<p>IoCs can be classified into Network Indicators (IP Addresses, Domain Names, URLs\/URIs, HTTP User Agents, Server Name Indicators, Network Protocols), Host Indicators (File Hashes, File Paths, Registry Keys, Mutex names, Named Pipes), and Behavioral Indicators (Patterns of Malicious Scripts, Unusual Processes, Tactics, Techniques, and Procedures).<\/p>"},{"question":"What challenges are associated with the use of Indicator of Compromise?","answer":"<p>The use of IoCs can come with challenges such as false positives, outdated IoCs, and lack of contextual information. However, these issues can be addressed by using high-quality, updated threat intelligence feeds, tools that provide rich context for IoCs, and regularly tuning and updating IoC matching tools and methodologies.<\/p>"},{"question":"How does an Indicator of Compromise compare with similar terms like Indicator of Attack and Threat Indicator?","answer":"<p>While an IoC is a piece of data that identifies potentially malicious activity, an Indicator of Attack (IoA) is evidence that an attack is currently happening or is about to occur. A Threat Indicator is a general term for either an IoC or an IoA that indicates potential or actual threats.<\/p>"},{"question":"How are proxy servers associated with Indicator of Compromise?","answer":"<p>Proxy servers, such as those provided by OneProxy, can inspect the data passing through them for IoCs, making them a valuable point for detecting and mitigating threats. Moreover, proxies can also be used to anonymize the source of IoCs, making it more challenging for threat actors to identify their targets.<\/p>"},{"question":"What are the future perspectives related to Indicator of Compromise?","answer":"<p>The future of IoCs lies in their integration with advanced technologies such as machine learning, artificial intelligence, and blockchain technology. These technologies can automate the collection and analysis of data, enhance detection capabilities, and improve the trustworthiness of threat intelligence data.<\/p>"}]},"_links":{"self":[{"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/wiki\/477571","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/wiki"}],"about":[{"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/types\/wiki"}],"version-history":[{"count":0,"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/wiki\/477571\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/media\/477572"}],"wp:attachment":[{"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/media?parent=477571"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}