Indicators of Future Attack

Indicators of Future Attack (IOFAs) act as real time, actionable, preemptive indications of attacker behavior and intent.

To reveal IOFAs, we apply unique behavioral fingerprints to attacker activity and search across our proprietary database – containing the most complete, accurate, and timely view of global internet-facing infrastructure anywhere in the world.

The problem with IOC-based Legacy Threat Intelligence

The majority of threat intelligence platforms are content with relying on public IOCs, OSINT data, crowdsourced intelligence and passive DNS sensors to gather intelligence. The problem? Only a smattering of this data is collected in realtime to produce actionable intelligence, if at all.

Frequent overlaps across data streams, with a considerable amount of false positives
Data drawn from multiple sources that isn’t designed to work together is inherently slower to search across
Data lacks a unifying set of characteristics that allow teams to organize it quickly and efficiently
Reduced operational efficiency

These tools only provide generic, reactive information on known threats at a given point in time, and don’t provide early warning of attacks. By providing Indicators of Future Attack (IOFAs) – security teams are able to identify and track adversary infrastructure before it’s weaponized.

Learn more about issues with Legacy Threat Intelligence

Leading the industry transition from IOC-based intelligence to IOFA-based intelligence

Considering that adversaries are constantly obfuscating their attacks and changing their TTPs, most contemporary IOC-based threat intelligence is stale and out of date, meaning that organizations can’t be proactive and hunt for developing threats before they launch. IOFAs are domains, IP addresses and DNS records that indicate attacker behavior and intent, meaning security teams can now stop threats BEFORE they’re weaponized.

A comprehensive Threat Intelligence strategy should incorporate IOFAs and other sources of intelligence, such as threat reports, threat hunting, and human intelligence.

Silent Push works closely with SOC managers and analysts, threat and security analysts, incident response teams, CISO and security architects to provide dynamic sources of actionable intelligence that are adaptable to all manner of attack vectors.

See Silent Push use cases