IoC Triage Game — TechKnowSurge

About this interactive

Triage is the skill that separates a security operations centre that works from one that is buried, and it is almost never taught directly. Modules list indicators of compromise — IP addresses, file hashes, domain names, registry keys — and students learn to recognise the categories. What they do not learn is that the category tells you almost nothing about severity. A registry Run key write is the most cited persistence indicator there is, and most Run key writes in a real environment are software installing itself. A changed system-binary hash is the classic file-integrity alarm, and most changed system binaries are patches. A first-seen external destination is a genuine detection primitive, and most first-seen destinations are somebody visiting a website for the first time. An analyst who grades the artifact instead of the evidence will page the on-call engineer for a vendor update and let a beacon sit in the queue behind it. This set is thirty-two indicators, each presented with the context an analyst would actually have, graded against a rubric stated in the instructions so the answer is defensible rather than a matter of taste: High is evidence of an active compromise, Medium is suspicious and unexplained with a benign reading still available, Low is a real but weak signal, and False Positive is an indicator with a verified benign cause. The pool is built in deliberate pairs. The Run key that launches encoded PowerShell thirty seconds after an attachment opened is High; the Run key that launches a vendor-signed EDR updater at the change-ticket timestamp is a false positive. The changed DLL hash that matches the vendor published hash for this month patch is a false positive; the changed cmd.exe whose Authenticode signature fails to validate is High. The unsigned zero-prevalence binary in a developer %APPDATA% that has never executed is Medium; the intelligence-matched loader dropped by a macro onto seven hosts is High. Facing a student with the same artifact twice and a different answer each time is the whole design, because it makes the mistake diagnosable: whoever gets one of a pair wrong skipped a specific clue, and the clue has a name. The technical grounding is deliberate rather than decorative. Every address that stands in for attacker infrastructure comes from the RFC 5737 documentation ranges, which cannot route and therefore cannot point at a real host, and one question makes that fact the answer — a vendor example rule firing on TEST-NET-1 is a false positive by definition. Link-local addressing under RFC 3927 appears as a DHCP failure rather than as an intrusion. Domain generation algorithms appear as a burst of NXDOMAIN with one success; DNS tunneling appears as thousands of TXT queries with long base32 labels; beaconing appears as a fixed interval and a constant payload size rather than as a word in the stem. Impossible travel is graded Medium on the geography alone and High only once the second session creates an external forwarding rule, because a VPN produces the first and nothing benign produces the second. Malicious domains are written defanged with bracketed dots, which is the convention analysts use and one more thing a student picks up by seeing it. Because quiz-game samples at random, the teaching has to survive whichever twelve are drawn: every stem contains the clue that decides it, and the four answer options never change, so the exercise is always reading evidence rather than reading options. The explanation naming that clue is shown to the student as soon as the answer is graded, so a miss says which piece of evidence was skipped rather than only that the bucket was wrong. Run it after the module lessons on Alerts, Logs and Beaconing, and again after the wrap; twelve of thirty-two means two consecutive rounds overlap without repeating, and the indicators that fooled you the first time come back.

What you'll learn

Triage an observed indicator of compromise into High, Medium, Low or False Positive against a stated severity rubric, and justify the placement from the evidence given rather than from the artifact type
Distinguish an indicator that evidences an active compromise from one that is merely suspicious, by testing whether the observed behaviour has any benign explanation that fits all of the evidence
Identify the context clues that resolve an indicator — threat-intelligence currency, registration age, code signing and file reputation, reserved and link-local address ranges, baselines, change records and the role of the account involved
Explain why the same artifact — a Run key write, a changed system-binary hash, a first-seen external destination — can be High severity in one context and a false positive in another
Recognise the common sources of false positives in a detection pipeline, including untuned vendor default rules, newly-observed-domain alerts, patch-driven file changes and authorised administrative activity, and explain why leaving them unresolved degrades detection

Aligned to

CompTIA Security+

2.4 Given a scenario, analyze indicators of malicious activity.

2.2 Explain common threat vectors and attack surfaces.

5.2 Explain elements of the risk management process.

CompTIA CySA+

1.3 Given a scenario, use appropriate tools or techniques to determine malicious activity.

Cisco CyberOps Associate

1.3 Describe security terms

1.9 Identify potential data loss from traffic profiles

NIST NICE

K0788 Knowledge of adversarial tactics principles and practices

Key terms

Indicators of Compromise: Indicators of Compromise are forensic artifacts such as file hashes, IP addresses, domain names, and registry keys that provide evidence a system may have been compromised, enabling threat detection and intelligence sharing.
Incident Triage: The initial assessment of a declared incident to determine its scope, affected systems, required personnel, and the approach for troubleshooting and resolution.
False Positive: An alert that fires when no actual issue exists, which over time can cause administrators to ignore notifications and reduce monitoring effectiveness.
True Positive: A scan result that correctly identifies a vulnerability that actually exists on the system.
Indicators of Attack: Indicators of Attack are real-time behavioral signals revealing that an attack is actively in progress, such as credential harvesting or lateral movement patterns, complementing IoCs which identify post-compromise artifacts.
Threat Intelligence: Information about existing or emerging threats that helps organizations make informed security decisions.
Risk Prioritization: The process of ranking identified risks by their potential impact and likelihood to determine which require the most urgent attention.
Beaconing: A pattern of regular, repeated outbound network communications from a compromised host to an attacker's command-and-control server.
Command and Control: Command and Control refers to the infrastructure and communication channels used by attackers to issue instructions to and receive data from compromised systems, enabling persistent access and coordinated attack operations.
Data Exfiltration: The unauthorized transfer of data from a system to an external destination.
Domain Generation Algorithm: An algorithm used by malware to automatically generate a large number of domain names that can be used as rendezvous points for command-and-control infrastructure, making detection and blocking difficult.
DNS Tunneling: A technique that encodes and smuggles data within DNS query and response messages to exfiltrate information from a network.
Typosquatting: A form of impersonation that registers misspelled or look-alike domain names to deceive users into visiting fraudulent websites.
Persistence: A MITRE ATT&CK tactic in which an adversary maintains their foothold within a compromised network to survive restarts, credential changes, or other interruptions.
Defense Evasion: A MITRE ATT&CK tactic in which adversaries take actions to avoid being detected by security tools and personnel during an attack.
Scheduled Task: A persistence technique in which an adversary configures the operating system to automatically execute malicious code at specified times or trigger events.
Hash Function: A mathematical algorithm that converts input data of any size into a fixed-size output value used to verify data integrity.
Secure Hash Algorithm: Secure Hash Algorithm is a family of cryptographic hash functions standardized by NIST, including SHA-1 (deprecated for most uses), SHA-256, and SHA-3, used for data integrity verification, digital signatures, and certificate validation.
Code Signing: The process of applying a digital signature to software using a certificate and private key so that users can verify the authenticity and integrity of downloaded programs.
Baseline: A documented set of minimum security standards or performance metrics used as a reference point.
Impossible Travel: A security alert triggered when account logins occur from geographically distant locations within a timeframe that makes physical travel impossible, indicating potential unauthorized access.
Security Information and Event Management: A system that aggregates and analyzes security event data from across an organization to detect and respond to threats.
Endpoint Detection and Response: A security solution that continuously monitors endpoint devices to detect, investigate, and respond to threats.
Threat Hunting: Threat hunting is a proactive security practice in which analysts actively search for signs of adversary activity that has evaded automated detection, using hypotheses driven by threat intelligence and behavioral anomalies.
Artifact: Data or information collected during a forensic investigation that provides insight into past system activity or events.
Anomaly: An observable deviation from expected behavior in a system or network that may indicate a performance issue or security threat.
Port Scanning: A technique used to discover open ports and services available on a networked device.
Signature-based Detection: A detection method that identifies threats by comparing network traffic or system activity against a database of known attack patterns and fingerprints.
Reputation-Based Filtering: A web filtering method that permits or denies access to websites based on their known trustworthiness or history of malicious activity.
Content Delivery Network: A globally distributed network of servers that caches and delivers content to users from the nearest geographic location to improve performance and availability.
Alerting: The automated notification process that triggers when monitored systems deviate from expected thresholds, informing administrators of potential issues.
Logging: A monitoring method that records system or network events as they occur, creating an auditable history of activity.

Topics

Interactive Quiz Game

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →