About IOC Scan

An indicator of compromise (IOC) is a set of data about an object or activity that indicates unauthorized access to the device (data compromise). For example, many unsuccessful attempts to sign in to the system can constitute an Indicator of Compromise. The IOC Scan task allows finding Indicators of Compromise on the device and performing threat response actions.

IOC files are used to search for IOCs. IOC files contain a set of indicators that are compared to the indicators of an event. If the compared indicators match, the EPP application considers the event to be alert. IOC files must conform to the OpenIOC standard.

Kaspersky Endpoint Detection and Response Optimum provides the following modes for running IOC Scan tasks:

• Standard IOC scan task is a group or local task that is created and configured manually in Kaspersky Security Center Web Console. The IOC files that you prepared are used to run the tasks.
• Stand-alone IOC scan task is a group task that is created automatically when responding to a threat detected by Kaspersky Sandbox. The EPP application automatically generates an IOC file. Operations with custom IOC files are not supported. Tasks are automatically deleted in seven days after the last start or after creation if tasks were never started. For more information about autonomous IOC Scan tasks, see Kaspersky Sandbox Help.

When an IOC is detected on a device, Kaspersky Endpoint Detection and Response Optimum performs the specified response action. The following response actions are available for the detected IOCs:

• Isolate device from the network.
• Run critical areas scan.
• Move the copy to the quarantine, and delete the object.

  As part of threat response, Kaspersky Endpoint Detection and Response Optimum and Kaspersky Sandbox can automatically create IOC Scan tasks. You can also create a task manually from the alert details window, in Kaspersky Endpoint Security for Windows or in Kaspersky Endpoint Agent.

  For details on how to run IOC Scan tasks, refer to Kaspersky Endpoint Security for Windows Help and Kaspersky Endpoint Agent Help.

Page top