Indicators of Compromise and Threat Intelligence

The video tutorial by Toby from Oine Security covers the basics of threat feeds and threat intelligence, explaining how they help in identifying indicators of compromise (IOCs). It explores tools like Alien Vault and Exploit Database, highlighting their roles in storing and sharing threat data. The tutorial also introduces the Google Hacking Database for advanced search techniques. Key takeaways include understanding the importance of threat intelligence in cybersecurity and familiarizing oneself with various databases and tools to stay updated on the latest threats.

What is the primary purpose of threat feeds?

• To monitor network traffic

• To protect personal data

• To create new malware

• To share threat intelligence

Which of the following is an indicator of compromise (IOC)?

• A new software update

• An unknown IP address on your network

• A scheduled system reboot

• A user login

What is Alien Vault primarily used for?

• Monitoring social media

• Sharing threat intelligence

• Storing personal data

• Creating new exploits

Which of the following is NOT an indicator of compromise found on Alien Vault?

• MAC address

• Hostname

• IP address

• File hash

What type of information can you find on Exploit Database?

• Personal user data

• Social media trends

• Weather forecasts

• System vulnerabilities and exploits

Which of the following is NOT a filter option in Exploit Database?

• Heap overflow

• Evil twin

• Code injection

• Authentication bypass

What is the purpose of Google's Hacking Database (GHDB)?

• To perform fine-tuned searches for sensitive information

• To monitor social media activity

• To store personal photos

• To create new malware

Which search expression can be used to find files containing passwords in GHDB?

• Files containing usernames

• Files containing passwords

• Files containing emails

• Files containing IP addresses

What is unique about Exploit Database compared to other exploit information sites?

• It offers weather forecasts

• It provides access to the source code of exploits

• It monitors social media for threats

• It stores personal user data

Which of the following is NOT a source of threat intelligence feeds?

• Government agencies

• Open source communities

• Dark web groups

• Commercial organizations