Conditions for Historical Records IOCs

The following table summarizes the conditions applicable for indicators used by Historical Records IOCs.

Items

Indicator

fileitem

fileextension

fullpath

filepath

filename

username

sha1sum

md5sum

created

modified

accessed

portitem

createiontime

process

remoteip

remoteport

localip

localport

processitem

name

username

sectionlist / memorysection / digitalsig / cert

sectionlist / memorysection / sha1sum

starttime

dnsentryitem

host

recorddata / host

recorddata / ipv4address

useritem

fullname

username

grouplist / groupname

registryitem

fullpath