Understanding Cyber Threats, IoCs, and Attack Methodology · Topic 4 of 4
Indicators of Compromise and Attack Frameworks
Learn IoC categories, IoCs versus IoAs, the Pyramid of Pain, the Cyber Kill Chain, MITRE ATT&CK tactics and the Diamond Model for CSA 312-39.
- 5 min
- Includes a diagram
- IoC categories: email, network, host based and behavioral.
- IoCs show a compromise happened. IoAs show an attack in progress.
- Pyramid of Pain, bottom to top: hashes, IPs, domains, artifacts, tools, TTPs.
What it is
An indicator of compromise (IoC) is evidence that a system has been or is being attacked, such as a malicious hash, a bad domain or an odd registry key. IoCs let a SOC search for and block known threats.
Attack methodology frameworks give a shared vocabulary for attack stages and techniques. The exam uses the Cyber Kill Chain, MITRE ATT&CK and the Diamond Model most.
How it works
IoC categories
| Category | Examples |
|---|---|
| Email indicators | Sender address, subject, attachment hash, links, failed SPF, DKIM or DMARC |
| Network indicators | Malicious IP addresses, domains and URLs, beaconing, large outbound transfers |
| Host based indicators | File hashes, file names and paths, registry keys, new services or scheduled tasks, unusual processes |
| Behavioral indicators | Logons at odd hours, PowerShell with encoded commands, mass file encryption |
IoCs of common attacks
| Attack | Typical IoCs |
|---|---|
| Brute force | Many 4625 failed logons, then a 4624 success from the same source |
| Ransomware | Many files renamed with a new extension, ransom notes, shadow copies deleted, spike in file writes |
| Data exfiltration | Large uploads to rare destinations, DNS tunneling |
| Web attack | SQL or script payloads in URLs, many 404 or 500 responses |
| Phishing | Failed email authentication, lookalike domains, Office apps spawning shells |
IoC versus IoA
| Aspect | IoC | IoA (indicator of attack) |
|---|---|---|
| Question | Has a compromise happened? | Is an attack in progress? |
| Focus | Artifacts left behind | Behavior and intent |
| Timing | Reactive | Proactive |
| Example | Known malware hash | A process dumping credentials from memory |
IoCs are shared as STIX over TAXII, and they go stale quickly because attackers change hashes and addresses easily.
Pyramid of Pain
The Pyramid of Pain ranks indicators by how much it hurts the attacker when defenders detect and deny them. From least to most pain:
| Level | Indicator | Pain to the attacker |
|---|---|---|
| 1 | Hash values | Trivial, recompile or change one byte |
| 2 | IP addresses | Easy, move to a new address |
| 3 | Domain names | Simple, register a new domain |
| 4 | Network and host artifacts | Annoying, change tool behavior |
| 5 | Tools | Challenging, find or build new tools |
| 6 | TTPs | Tough, change how they operate |
Cyber Kill Chain
Lockheed Martin's Cyber Kill Chain has seven stages:
| Stage | What happens |
|---|---|
| Reconnaissance | Research the target, harvest email addresses |
| Weaponization | Pair an exploit with a payload, such as a malicious document |
| Delivery | Send the weapon: email, web, USB |
| Exploitation | The exploit runs on the victim system |
| Installation | Malware or a backdoor is installed for persistence |
| Command and Control | The implant connects back to the attacker |
| Actions on Objectives | Data theft, encryption, destruction |
Breaking the chain at any stage can stop the attack, and earlier is cheaper.
MITRE ATT&CK
MITRE ATT&CK is a knowledge base of real adversary behavior. Its Enterprise matrix lists tactics (the why), each with techniques and sub techniques (the how), identified by IDs such as T1059 (Command and Scripting Interpreter). The current release, v20 (2026), has 15 Enterprise tactics.
| Tactic | Goal |
|---|---|
| Reconnaissance | Gather information to plan |
| Resource Development | Build infrastructure, accounts, tools |
| Initial Access | Get into the network |
| Execution | Run malicious code |
| Persistence | Keep the foothold |
| Privilege Escalation | Gain higher permissions |
| Stealth (TA0005, formerly Defense Evasion) | Hide actions and look like normal activity |
| Defense Impairment (TA0112, new in v20) | Disable or weaken security tools and controls |
| Credential Access | Steal account names and passwords |
| Discovery | Learn the environment |
| Lateral Movement | Move through the environment |
| Collection | Gather data of interest |
| Command and Control | Communicate with compromised systems |
| Exfiltration | Steal data out |
| Impact | Disrupt, destroy or encrypt |
Older material, and many exam questions, use the earlier 14 tactic list, where Defense Evasion covered both hiding (such as clearing logs) and disabling defenses (such as stopping antivirus). Treat Defense Evasion as the same idea. SOCs map detection rules to ATT&CK techniques to see coverage gaps.
Diamond Model and hacking phases
The Diamond Model links four features of every intrusion event: adversary, capability, infrastructure and victim.
EC-Council's hacking methodology has five phases: reconnaissance, scanning, gaining access, maintaining access and clearing tracks.
A worked example
An analyst finds a phishing email with a macro document, PowerShell launched by Word, a new scheduled task, and beacons to a rare domain. In kill chain terms these are Delivery, Exploitation, Installation and Command and Control.
In ATT&CK terms they are Initial Access, Execution, Persistence and Command and Control. Blocking the domain stops this sample, but detecting the PowerShell behavior, a TTP, hurts the attacker more.
How the exam asks about this
- "Which kill chain stage pairs an exploit with a payload?" → Weaponization.
- "Which indicator on the Pyramid of Pain is easiest for an attacker to change?" → Hash values.
- "Which ATT&CK tactic covers moving from one compromised host to others?" → Lateral Movement.
What to remember for the exam
- IoC categories: email, network, host based and behavioral.
- IoCs show a compromise happened. IoAs show an attack in progress.
- Pyramid of Pain, bottom to top: hashes, IPs, domains, artifacts, tools, TTPs.
- Kill chain: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, Actions on Objectives.
- Diamond Model: adversary, capability, infrastructure, victim.
Do not confuse kill chain stages with ATT&CK tactics. "Weaponization" is only in the kill chain, and "Credential Access" and "Discovery" are only in ATT&CK.
Common mistakes
Relying only on hash and IP blocklists. They sit at the bottom of the pyramid and go stale fast.
Mixing up Exploitation and Installation. Exploitation runs the code. Installation adds the persistent backdoor.
Calling techniques tactics. Persistence is a tactic. A scheduled task is a technique.
Check yourself
Which IoC category does a malicious registry Run key belong to?
Host based indicators, because it is an artifact on the system itself.
Why do TTPs sit at the top of the Pyramid of Pain?
Changing how they operate is the hardest and most costly thing for an attacker to do.
What are the four features of the Diamond Model?
Adversary, capability, infrastructure and victim.
Topic 4 of 4 in Understanding Cyber Threats, IoCs, and Attack Methodology
Test yourself on Understanding Cyber Threats, IoCs, and Attack Methodology
The full EC-Council 312-39 question bank has 700 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.