17. IOC DETECTION DOWNSIDES
• Which areas do we watch?
• Some suspicious mechanisms are used by innocent
software as well.
18. IOC DETECTION DOWNSIDES
• Which areas do we watch?
• Some suspicious mechanisms are used by innocent
software as well.
• Attackers can see and sometimes circumvent alarms.