A Study on Hacking E-Mail Detection using Indicators of Compromise

Abstract

In recent years, hacking and malware techniques have evolved and become sophisticated and complex, and numerous c yber-attacks are constantly occurring in various fields. Among them, the most widely used route for compromise incident s such as information leakage and system destruction was found to be E-Mails. In particular, it is still difficult to detect and identify E-Mail APT attacks that employ zero-day vulnerabilities and social engineering hacking techniques by detec ting signatures and conducting dynamic analysis only. Thus, there has been an increased demand for indicators of compr omise (IOC) to identify the causes of malicious activities and quickly respond to similar compromise incidents by sharing the information. In this study, we propose a method of extracting various forensic artifacts required for detecting and inv estigating Hacking E-Mails, which account for large portion of damages in security incidents. To achieve this, we employ ed a digital forensic indicator method that was previously utilized to collect information of client-side incidents.