RISE_Resources

“OpenIOC: Back to the Basics” – Will Gibb & Devon Kerr, Mandiant (https://www.mandiant.com/resources/openioc-basics)

"OpenIOC Series: Investigating with Indicators of Compromise Part I" - Devon Kerr & Will Gibb, Mandiant (https://tagteam.harvard.edu/hub_feeds/4280/feed_items/2841563)

"Investigating with Indicators of Compromise - Part II" - Will Gibb, Mandiant (https://web.archive.org/web/20201002151008/https://www.fireeye.com/blog/threat-research/2014/03/investigating-indicators-compromise-iocs-part-ii.html)

"The Origin of the Term Indicator of Compromise" - Richard Bejtlich (https://taosecurity.blogspot.com/2018/11/the-origin-of-term-indicators-of.html)

“Misunderstanding Indicators of Compromise” - Dave Dittrich & Katherine Carpenter (https://threatpost.com/misunderstanding-indicators-of-compromise/117560/)

“Indicators and Network Defense” – Joe Slowik (https://pylos.co/2018/05/16/indicators-and-network-defense/)

“Formulating a Robust Pivoting Methodology” – Joe Slowik, DomainTools (https://www.domaintools.com/content/formulating-a-robust-pivoting-methodology.pdf)

“Analyzing Network Infrastructure as Composite Objects” – Joe Slowik, DomainTools (https://www.domaintools.com/resources/blog/analyzing-network-infrastructure-as-composite-objects)

“Threat Intelligence and the Limits of Malware Analysis” – Joe Slowik, Dragos (https://www.dragos.com/wp-content/uploads/Threat-Intelligence-and-the-Limits-of-Malware-Analysis.pdf)