## Identifying IOCs from Malware

You've analyzed the malware. You have pages of notes. Now, what do you do? You need to extract **Actionable Intelligence**.

### The Pyramid of Pain
Not all IOCs are equal. David Bianco's "Pyramid of Pain" describes how hard it is for an attacker to change their IOCs vs how hard it is for you to detect them.

#### 1. Hash Values (Bottom - Trivial)
*   **What**: MD5/SHA256 of the file.
*   **Attacker Effort**: Trivial. Change 1 byte, hash changes.
*   **Value**: Low. Only catches that *one* specific file.

#### 2. IP Addresses (Easy)
*   **What**: C2 Server IP.
*   **Attacker Effort**: Easy. Change IP using a Proxy/VPN.
*   **Value**: Low/Medium. IPs serve many domains.

#### 3. Domain Names (Simple)
*   **What**: `evil.com`.
*   **Attacker Effort**: Simple. Register a new domain (`evil2.com`).
*   **Value**: Medium. Requires money/time for attacker.

#### 4. Network/Host Artifacts (Annoying)
*   **What**: User-Agent strings, specific registry keys, distinctive filename patterns.
*   **Attacker Effort**: Annoying. Tthey have to rewrite their code config.
*   **Value**: High. Catches the *tool*.

#### 5. Tools (Challenging)
*   **What**: Detecting the tool itself (e.g., Cobalt Strike beacon) regardless of config.
*   **Attacker Effort**: Challenging. They have to write a new tool from scratch.

#### 6. TTPs (Top - Tough)
*   **What**: Tactics, Techniques, and Procedures. (Behavior).
*   **Example**: "Pass-the-Hash", "Spearphishing with Macros".
*   **Attacker Effort**: Tough. They have to learn a whole new way of hacking.
*   **Value**: **Highest**. If you detect "Pass-the-Hash", you catch them no matter what tool they use.

### Creating the Report
Your Malware Analysis Report should contain:
1.  **Executive Summary**: "This is ransomware. It spreads via SMB. Risk is Critical."
2.  **Technical Details**:
    *   Packer used.
    *   Compilation timestamp.
    *   Capabilities.
3.  **IOC List (The "Blocklist")**:
    *   `Hash: e3b0c442...`
    *   `Domain: update-microsoft-support.com`
    *   `IP: 192.0.2.1`
    *   `File: C:WindowsTempwinlogon_update.exe`
4.  **YARA Rules**: A way to describe the malware pattern to hunt for it across the organization.