Chapter 15
Analyzing Application-Related IOCs

Application-related IOCs are observable signs of compromise found in the behaviour and logs of applications running on top of an operating system. They complement host-based IOCs (which focus on the OS itself) by revealing what individual applications — web servers, databases, email clients, FTP services — are actually doing.

Anomalous activity is any application behaviour that deviates from the established baseline — whether it's network connections that shouldn't exist, output that doesn't match the expected schema, or visible changes to web content. The first step is always determining if the anomaly is benign or malicious.

A service interruption is not automatically an attack — services fail for many reasons including hardware faults, software bugs, misconfiguration, and exhausted resources. The analyst's job is to determine whether a given interruption is malicious. Context is everything: is a security service being killed? Is a DoS attack in progress? Is the service repeatedly failing after restart attempts?

Four causes worth investigating

Service analysis tools

Application logs are the richest source of application-layer IOCs. Each log type uses different formats and status codes — but all follow the same analytical principle: compare observed entries against the expected baseline, and flag anything that deviates.

HTTP status code reference

DNS event logs

DNS event logs record every request to resolve a domain name to an IP address. They capture the querying user, computer, query type, domain requested, and result. For threat hunting, look for unusual record types (TXT, MX, NULL when most traffic should be A records), repeated queries to the same domain at regular intervals (beaconing IOC), and unusually long domain names (DNS tunnelling).

HTTP access logs — annotated walkthrough (signature element)

FTP access log — annotated walkthrough

FTP status codes

SSH access log — login success and brute-force detection

SQL event logs

SQL event logs record server startup/shutdown events, database events, and individual query strings. They can reveal data breach attempts — SQL injection attacks will appear as unusual or malformed query strings, often with UNION SELECT, OR 1=1, or DROP TABLE patterns. The format varies by database vendor (MySQL, MSSQL, PostgreSQL).

One of the first things an attacker does after gaining access is create additional accounts — especially administrator accounts — to ensure continued access even if the initial intrusion vector is closed. All account creation should go through a monitored change control process so that any rogue account is caught quickly.

Windows account analysis tools

Linux session and account management tools

Virtualized environments introduce unique forensic challenges. Virtual machines can be spun up instantly and destroyed just as quickly (elasticity), making traditional evidence collection approaches difficult or impossible. The key is anticipating these challenges before an incident and designing the infrastructure accordingly.

Mobile devices in enterprise environments connect to corporate networks via VPN — making a compromised mobile device a potential entry point into the corporate network. Mobile forensics is required when a device is suspected of being the intrusion vector or when it contains evidence of a compromise.

Unique challenges of mobile forensics

Four extraction methods

Mobile forensics tools

Carrier-provided logs (law enforcement only)

Mobile carriers retain records of device activity that can be subpoenaed with a valid warrant. This is only available to law enforcement — corporate security teams cannot obtain these. Note that retention periods are short and PII is subject to privacy law deletion requirements — request data quickly once the investigation begins.