Senior Threat Researcher Zach Edwards explains how to stay left of the boom with proactive cyber defence. By tracking both static and change data, organizations can identify attacker infrastructure before it is weaponized.
Key topics covered:
The difference between static data and change data in threat detection
How threat actors adapt to evade detection
Fingerprinting attacker infrastructure to spot emerging campaigns
Monitoring DNS and infrastructure changes for early warning
Tools and strategies for proactive threat hunting
The full session is essential viewing for CISOs, threat hunters, and security teams looking to stay ahead of advanced threat actors.
Every reactive investigation is an opportunity to build a proactive hunt. Let’s take a real-world phishing email (a “Ledger” phish) and show how to pivot “upstream.”
The Reactive Clues: The investigation starts with email headers.
We find IPs like 149.72.223.116 and 159.183.183.61, which indicate compromised SendGrid accounts. Using PTR (reverse DNS) records helps identify the sender, but this is all after-the-fact analysis. The malicious link itself was ledger-recovery-app[.]com.
The Proactive Pivots: Instead of stopping, we use that domain as our first “thread” to pull. Content Pivot: We can hunt for other sites that share the same characteristics. A simple query can find all domains that also have an HTML Title of “Are you human?” and a URL that contains “ledger”.
This immediately widens the net.
Domain/WHOIS Pivot: We can hunt for similar domains before they’re armed. Attackers use predictable patterns.
We can build a proactive query to find all domains where: Domain is one of: ledger-*-*.com OR *-ledger-*.com AND Registrar is: Amazon Registrar, Inc. This query finds domains the moment they’re registered, long before they’re ever used in an email campaign.
Try this example yourself using our free Community Edition:
Threat actors are lazy. They reuse the same server configurations, even when they host different campaigns. Instead of hunting for content (which changes), we can hunt for the server’s unique technical “fingerprint.”
The Example: A phishing domain harborfrieght[.]shop was identified. The Technique: We can extract the server’s unique technical signatures. Even if the actor hosts a completely different lure (like a “jeans ad” found in the wild), the underlying server setup is often identical.
The Goal: Run a query to find all domains hosted on infrastructure with these exact HHV and JARM fingerprints. This technique cuts through the noise of different domain names and content, tying disparate campaigns to a single actor.
The Result: This precise, multi-layered search successfully identifies high-fidelity phishing sites, such as the convincing clone gmaii.email, while completely ignoring legitimate Google infrastructure.
Try this example yourself using our free Community Edition:
Proactively finding convincing clones of a major brand like Gmail is difficult; the internet is full of legitimate and benign sites that use the word “gmail.” The key is to use a multi-layered query that combines data points to filter out the noise.
The Technique: We can build a query that stacks several conditions to find only the fakes.
Search Logic:
Pivot on Favicon: First, find all sites using the official Gmail favicon hash.
Filter by Content: Add a condition that the HTML Title must contain “gmail”.
Exclude Legitimate Sites: This is the most important step. Filter out any site where the SSL Issuer Organization is “Google Trust Services” (as this would be a real Google-owned property).
The Result: This precise, multi-layered search successfully identifies high-fidelity phishing sites, such as the convincing clone gmaii.email, while completely ignoring legitimate Google infrastructure.
Try this example yourself using our free Community Edition:
Power up your Palo Alto XSOAR environment with Silent Push’s threat intelligence capabilities. This integration enables on-demand lookups and automated workflows for domains, IP addresses, nameservers, and Indicators of Future Attack (IOFA)™ feeds, streamlining incident response and threat hunting.
Try this tool using our free Community Edition, and let us know what you think.
Whether you’re a threat hunter, SOC analyst, incident responser or just curious about how phishing campaigns are unraveled, this hands-on walkthrough offers practical insight into modern, preemptive threat detection.
Try this tool using our free Community Edition, and let us know what you think.
Threat actors reuse HTML templates to create malicious sites at scale. Traditionally, finding these required a complex, multi-step process and scripting skills. With HTML Content Similarity Search, it’s now simple. Get deduplicated, high-relevance results – no coding needed.
Try this tool using our free Community Edition, and let us know what you think.
Both indicators play an important role in cyber defense, but only one tells you what’s coming.
With traditional security tools, your threat feed tells you what happened: the domain was malicious, the IP address was flagged, or the hash matched a known-bad sample. All of that is true, but it describes an attack that has already occurred.
For decades, Indicators of Compromise (IOCs) have been the foundation of threat intelligence, and they remain valuable. But as adversaries grow more sophisticated, registering fresh infrastructure for every campaign, aging domains deliberately to evade detection, and moving on before feeds pick them up, a defense built entirely on what has already happened has a structural problem.
Silent Push Indicators of Future Attack® (IOFA) solve that problem. Where an IOC confirms what’s previously occurred, IOFA reveal what’s being prepared. Understanding the difference between the two indicators and how each serves your team is increasingly central to modern security organizations’ defense. It’s also the foundation of a growing strategic shift: from reactive cyber defense to Preemptive Cyber Defense.
What Is an IOC?
An IOC is a reactive cybersecurity data point. It tells you that a system has been targeted or compromised; an attack has occurred or is actively underway. IOCs include known malicious domains, IP addresses, file hashes, registry keys, and similar forensic artifacts that confirm prior malicious activity.
IOCs are widely used and broadly distributed through OSINT streams, licensed threat intelligence platforms, public forums, and Advanced Persistent Threat (APT) intelligence reports. They form the backbone of most threat feeds and have been the predominant mode of threat intelligence for legacy solutions.
IOCs are valuable, but they’re inherently backward-looking. By the time an IOC exists, a perimeter’s been breached, leaving the IOC as a record of the event.
What Are IOFA?
In contrast, IOFA are proactive: they include hostnames, domains, or IP addresses that reveal technical fingerprints where or how an attack will be launched, before it happens.
Silent Push is the only cybersecurity vendor that generates IOFA. They are produced by the Silent Push Context Graph, which continuously maps global internet infrastructure, analyzing domain registrations, DNS resolutions, hosting patterns, certificate rotations, and more than 150 behavioral attributes to identify adversary staging activity before a campaign is weaponized.
Whereas an IOC is a forensic artifact of a past event, IOFA are verified signals of threats in the preparation phases. Security teams that act on IOFA data can block adversary infrastructure during staging, before a single alert fires in their SIEM.
The Core Difference: When Defense Begins
The most important distinction between IOCs and IOFA is timing, specifically, where on the attack timeline each type of indicator appears.
Traditional security models depend on what’s known as a “patient zero” moment: an asset inside the perimeter is compromised, an alert fires, and defense begins. By that point, the adversary has already registered infrastructure, aged it to appear legitimate, and launched the campaign. The IOC exists because the attack has already reached you.
IOFA shift the timeline dramatically and the Context Graph detects behavioral patterns consistent with adversary staging weeks, or sometimes months, before a campaign goes live. A Fortune 500 media and entertainment company that embedded Silent Push IOFA into its SIEM workflows achieved an average early-detection lead time of 104 days, identifying adversary infrastructure tied to FIN7, Lazarus Group, and PoisonSeed well before those indicators ever appeared in traditional tooling. In some cases, lead time exceeded 300 days, especially with APTs.
How Each Indicator Type Serves Security Personas
SOC Managers
Security Operations Center (SOC) Managers working from IOC-based feeds respond to activity that’s already running. The infrastructure has been live for weeks, the campaign is operational, and alert volume is climbing. Integrating IOFA into your existing stack gives your team lead time to push verified indicators into blocklists and validate staging infrastructure before the volume spike happens. Your analysts are working from current adversary data rather than reacting to events in motion.
IR Analysts
Incident Response (IR) Analysts arrive at an active breach, beginning with a single known indicator. What that indicator rarely provides is a complete picture of what the attacker has staged and is ready to use. Adversaries build infrastructure with redundancy, so if your remediation only covers the assets identified during the active investigation, there’s a good chance the attacker has left themselves a route back in. Silent Push tracks infrastructure relationships, DNS history, and WHOIS lineage so a single starting indicator can be expanded into the full cluster of adversary-controlled assets. This includes fallback infrastructure that attackers rely on if their primary domains or IPs are discovered.
CTI Analysts
Cyber Threat Intelligence (CTI) Analysts deliver post-breach briefs that document what has already happened. This limits what a SOC can do with the output. Delivering IOFA for infrastructure that’s being staged, before it becomes an IOC, changes the operational value of that brief. The Context Graph pre-correlates across 150+ behavioral parameters, so that when you run queries, the clustering is already complete, and the pivot work starts from an earlier position.
CISOs
Chief Information Security Officers (CISOs) face a recurring challenge: explaining security value in terms that resonate beyond the SOC. IOCs support post-incident reporting by documenting what was caught after an attack began. IOFA support a more compelling narrative: incidents that never happened because adversary infrastructure was neutralized before it was compromised. That’s board-level ROI and the most defensible cybersecurity investment case available.
Why IOCs Alone Are No Longer Enough
This isn’t an argument against IOCs. They remain useful for confirming compromise, supporting forensic investigation, and feeding detection rules. Every mature security program uses them.
But IOC-led defense has structural limitations that become more pronounced as threat actors evolve. Adversaries cycle through infrastructure rapidly, registering new domains and IPs specifically to evade blocklists built on historical IOCs. An IOC-based feed that captures a domain after it’s been used in an attack offers little protection against the same actor’s next campaign launched from fresh infrastructure.
IOC feeds are also noisy. Since they aggregate data from multiple sources without a unified scoring methodology, they carry a high rate of false positives and stale indicators. This taxes analysts on indicators that no longer represent live threats.
IOFA address both problems: targeting adversary TTPs, the consistent behavioral patterns that persist even as infrastructure changes, and they carry attributable true-positive indicators that don’t require manual validation.
The Context Graph: Where IOFA Come From
IOFA are not threat scores or probability estimates. They are deterministic signals produced by analyzing internet infrastructure at scale.
The Context Graph is a continuously updated map of the observable internet, analyzing both benign and malicious infrastructure in parallel. When emerging hosting patterns, DNS behaviors, or naming conventions match known adversary TTPs, the Context Graph generates an IOFA: a verified signal that a staging ground is active.
Each indicator carries 150+ searchable attributes, enabling one-click pivots across related infrastructure, historical DNS, and shared hosting patterns. This gives SOC and IR teams the ability to immediately understand the full scope of an adversary’s deployment, not just a single data point, but the connected infrastructure around it.
For a real-world view of what the Context Graph surfaces, the “Five Things the Silent Push Context Graph Showed Us” blog walks through concrete examples of threat actor infrastructure discovered during the staging phase, before any attack launches.
Quick Reference: IOC vs. IOFA
IOC
IOFA
What it tells you
An attack has occurred or is active
An attack is being prepared
When it appears
After compromise
During adversary staging
Primary use
Forensic investigation, detection
Preemptive blocking, threat hunting
Source
Multiple aggregated feeds
Silent Push Context Graph only
False positive rate
High (noisy, stale indicators common)
Low (attributable, validated true positives)
Lead time
Zero, reactive by definition
Average 104 days; up to 300+ days
Infrastructure tracking
Static snapshot
Dynamic, tracks adversary movement
The Strategic Shift: Preemptive Cyber Defense
The difference between IOCs and IOFA maps the difference between reactive and preemptive cyber defense. One approach waits for evidence of compromise, while the other identifies adversary infrastructure while it’s still being built.
Gartner projects that adoption of Preemptive Cyber Defense solutions will grow from 5% to 35% by 2028, driven by organizations recognizing that proactive mechanisms of defense deliver fundamentally different outcomes than detection and response.
Preemptive Cyber Defense doesn’t replace your existing security stack; it evolves it, giving your SIEM, SOAR, and TIP platforms the upstream intelligence they need to act before an attack hits, rather than after.
IOCs remain valuable, but it’s whether they are sufficient when an adversary has already moved on to its next piece of infrastructure before your feed ever picks up the last one.
Learn More About Enabling Preemptive and Deterministic Cyber Defense
Our “Shifting Left” white paper provides more in-depth reporting on how preemptive cyber defense moves earlier in the attack lifecycle to identify verified adversary infrastructure during the staging phase, before attacks begin.
Interested in seeing Silent Push IOFA and the Context Graph in action?
Start a conversation with one of our platform experts to learn how preemptive cyber defense can give your team weeks, or longer, of lead time on adversary infrastructure, before an attack is ever launched.
We also offer a free Community Edition so defenders can see how our platform integrates with their existing security stack.
FAQs
Do I need to replace my existing IOC-based tools to use Silent Push IOFA?
No. Silent Push Preemptive Cyber Defense is designed to work alongside your existing security stack, not replace it. IOFA feed directly into your SIEM, SOAR, and TIP platforms via API and native integrations. This adds upstream visibility into adversary staging activity that your current tools were never designed to see. Think of it as activating what you already have with earlier, higher-confidence intelligence.
How far in advance can IOFA detect adversary infrastructure?
The average early-detection lead time is 104 days, compared with a traditional SIEM alert. For APT campaigns, lead times have exceeded 300 days. That means security teams using Silent Push are often working with verified intelligence on adversary infrastructure months before that infrastructure is ever weaponized, and long before it appears in any conventional threat feed.
See how Silent Push analysts mapped the DriveSurge malware campaign, uncovering the infrastructure behind ClickFix, FakeUpdates, and thousands of compromised websites.
This video explores the technical fingerprints defenders can use to identify connected domains and detect malicious infrastructure earlier.
IOFA give SOC teams verified signals tied to adversary infrastructure that’s still in staging, before a campaign launches. That’s the difference between reacting to a breach and stopping one.
