# IOC Types Reference

## Network Indicators

### IP Addresses
- **IPv4**: Standard dotted-decimal notation (e.g., `192.168.1.1`)
- **IPv6**: Colon-separated hexadecimal (e.g., `2001:db8::1`)
- **Context**: C2 servers, exfiltration endpoints, scanning sources

### Domain Names
- Fully qualified domain names used for C2, phishing, or staging
- Include subdomains and dynamic DNS entries
- Watch for DGA-generated domains (high entropy, unusual TLDs)

### URLs
- Full paths including protocol, domain, port, path, and parameters
- May include encoded payloads in query strings
- Track callback URLs, download URLs, and exfiltration endpoints

### Email Addresses
- Sender addresses from phishing campaigns
- Registration emails for malicious infrastructure
- Contact points in ransom notes

## File Indicators

### Hashes
| Type | Length | Example |
|------|--------|---------|
| MD5 | 32 hex chars | `d41d8cd98f00b204e9800998ecf8427e` |
| SHA-1 | 40 hex chars | `da39a3ee5e6b4b0d3255bfef95601890afd80709` |
| SHA-256 | 64 hex chars | `e3b0c44298fc1c149afbf4c8996fb924...` |
| ssdeep | Variable | Fuzzy hash for similarity matching |
| TLSH | 72 hex chars | Trend Micro Locality Sensitive Hash |
| imphash | 32 hex chars | Import hash for PE files |

### File Names and Paths
- Dropped file names and locations
- Temporary files created during execution
- Modified system files

## Host Indicators

### Registry Keys
- Persistence locations (Run keys, services, scheduled tasks)
- Configuration storage
- Common keys:
  - `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run`
  - `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run`
  - `HKLM\SYSTEM\CurrentControlSet\Services`

### Mutexes / Mutants
- Named synchronization objects for single-instance enforcement
- Often unique identifiers for malware families
- Format: `Global\<name>` or `Local\<name>`

### Named Pipes
- Inter-process communication channels
- Used by lateral movement tools (e.g., PsExec, Cobalt Strike)
- Format: `\\.\pipe\<name>`

### Services
- Service names and display names created for persistence
- Service DLL paths
- Service descriptions

### Scheduled Tasks
- Task names and trigger configurations
- Associated executables and arguments

## Behavioral Indicators

### YARA Rules
- Pattern-matching rules for file and memory scanning
- Can encode complex multi-condition logic

### Sigma Rules
- Detection rules for log-based indicators
- Platform-agnostic format for SIEM integration

### MITRE ATT&CK Techniques
- Technique IDs mapping observed behaviors
- Provide context for understanding attack methodology

## Crypto and Financial

### Bitcoin Addresses
- Payment addresses in ransom notes
- Start with `1`, `3`, or `bc1`

### Monero Addresses
- Privacy-focused cryptocurrency addresses
- 95-character strings starting with `4`

### Encryption Keys
- Hardcoded encryption keys found in malware
- RSA public keys, AES keys, XOR keys