From Reactive to Proactive: How a Financial Firm Transformed Incident Response with IOC Collection and Analysis

Executive Summary / Key Results

A mid-sized financial services firm reduced its mean time to detect (MTTD) from 48 hours to under 4 hours by implementing a structured program for collecting and analyzing indicators of compromise (IOCs). The program, built around automated threat intelligence feeds and systematic pivot analysis, also cut the incident response cycle by 60% and stopped 12 repeat attacks in the first quarter alone. The key: moving beyond simple hash-based IOCs up the Pyramid of Pain to include TTPs and behavioral indicators, enabling the team to catch adversaries earlier and with fewer false positives.

Background / Challenge

The Reactive Trap

The firm’s security operations center (SOC) was drowning in alerts. With a team of eight analysts covering a 2,500-user environment across five offices, they relied on signature-based detection from a legacy SIEM. Most IOCs in their feeds were file hashes and static IP addresses — easy to collect, but also easy for attackers to change. As David Bianco’s Pyramid of Pain illustrates, file hashes sit at the base: trivial for adversaries to modify with every new build. The team found itself chasing fresh hashes daily, with no visibility into attacker behavior.

The Breaking Point

A ransomware incident in Q2 2023 made the problem urgent. The attacker used a previously unknown variant that evaded file-hash detection. By the time the SOC identified the malicious executable, encryption had spread to 200 workstations, costing the firm $1.2 million in recovery and downtime. Post-incident analysis revealed that the attacker’s command-and-control IP address was already in an open-source threat feed — but set to a “low confidence” tag, so it never triggered an alert.

Solution / Approach

Redefining IOC Collection

The firm adopted a three-tier collection strategy aligned with RFC 9424’s guidance on IOC types and sources:

• In-house technical data: They expanded logging from endpoints, network flows, and Active Directory to capture process creation, network connections, and registry changes. This telemetry became the foundation for finding associated malicious behavior when any IOC was triggered.
• External threat feeds: They integrated two commercial feeds and one open-source feed, but with a twist — each feed’s indicators were scored based on context (e.g., recent sightings, associated malware family, ATT&CK techniques) to filter noise.
• Proactive extraction: The threat hunting team began analyzing domain registration patterns and certificate transparency logs to predict attacker infrastructure before it was used.

Moving Up the Pyramid

The team committed to extracting indicators at higher levels of the Pyramid of Pain. For every confirmed incident, they mapped IOCs to MITRE ATT&CK techniques and tactics. This turned a single malicious IP address into a behavioral fingerprint: “This attacker always uses PowerShell Empire, establishes scheduled tasks for persistence (T1053.005), and exfiltrates via HTTPS over port 443.” Such TTP-based IOCs are far harder for attackers to change than a hash or domain.

Implementation

Phase 1: Automate Collection and Enrichment (First 8 Weeks)

The team deployed a threat intelligence platform (TIP) to aggregate IOCs from internal telemetry and external feeds. Every incoming IOC was automatically enriched via:

• WHOIS lookups (domain age, registrar)
• Passive DNS history
• Sandbox analysis reports (if file hash)
• GeoIP and ASN data

Enrichment transformed a bare IP like 198.51.100.5 into actionable intelligence: “Registered 3 days ago, hosted on AS12345, associated with Dridex loader samples in three sandboxes, targeting finance vertical”.

Phase 2: Pivot and Validate (Weeks 9–16)

Analysts adopted a pivot workflow. When a hash was flagged, they searched their internal telemetry for any other systems that had contacted associated IPs or domains. One such pivot uncovered a dormant backdoor installed weeks earlier — missed by signature detection because it used a custom domain that had never been observed before.

Validation meant checking whether an IOC actually represented malicious activity in their environment. For example, a public DNS sinkhole feed listed 10.0.0.1 as a C2 server — but that RFC1918 address could never be a real C2 in their network. The team built a validation layer that removed such obvious false positives before IOCs reached detection rules.

Phase 3: Operationalize and Share (Ongoing)

Every completed investigation resulted in a report containing all IOCs and indicators of attack (IOAs) based on them. These were automatically added to monitoring systems and shared with industry peers via an Information Sharing and Analysis Center (ISAC). The firm also contributed anonymized IOCs to open-source feeds, strengthening the broader community.

Results with Specific Metrics

Key Takeaways

1. Collection Without Context Is Noise

The biggest win came from enrichment, not volume. Raw IOCs without context are almost useless. By automating enrichment and filtering, the firm reduced analyst fatigue and caught threats they would have missed.

2. Pivot Analysis Multiplies Detection

A single IOC from an external feed led to pivoting that uncovered five additional compromised hosts the attackers hadn’t used yet. This technique — searching proprietary telemetry for associated behaviors — is the most precious source of intelligence because it provides unique data from trusted systems.

3. TTPs Trump Hashes

When the team started mapping IOCs to ATT&CK techniques, they could block entire attack patterns rather than chasing individual hashes. The more specific an IOC, the more fragile it is; but TTP-based indicators offer robustness and longevity.

4. Sharing Is a Force Multiplier

By joining a threat intelligence sharing community, the firm received early warnings about campaigns targeting financial services. They also contributed their own findings, building reciprocity that expanded their visibility beyond their own network.

Conclusion

This financial firm’s transformation shows that effective IOC collection and analysis is not about the quantity of indicators but about their quality and the workflow around them. By moving up the Pyramid of Pain, enriching indicators with context, and pivoting to uncover related activities, the SOC shifted from reactive cleanup to proactive defense. The result: faster detection, fewer incidents, and a team that spends less time on false alarms and more on hunting real adversaries.

Organizations aiming to replicate this success should start by (1) auditing their current IOC sources and enrichment capabilities, (2) training analysts to pivot from any IOC to associated behaviors, and (3) establishing a feedback loop where each investigation feeds new, higher-value IOCs into detection systems. For deeper guidance on sourcing and integrating IOCs, see Threat Intelligence Sources and Collection Methods: A Complete Guide and Commercial Threat Intelligence Feeds: How to Choose and Integrate.

About Infosecurity Magazine

Infosecurity Magazine is an award-winning online publication dedicated to providing news, features, and resources on information security, covering topics from strategy to technology for cybersecurity professionals. Through timely news, expert analysis, educational webinars, and industry event coverage, we help security teams stay ahead of evolving threats.