# =============================================================================
#  lab7-iocs.txt
#  Lab 7 - Threat Intelligence Investigation
#  Runs on: WIN11 (192.168.1.40) - browser-based enrichment
#  (CDB list build in Part 3 is on WAZUH-SRV, 192.168.1.30)
# =============================================================================
#  This file contains a MIXED set of indicators of compromise (IOCs) presented
#  as if extracted from a recent investigation. Some are genuinely malicious;
#  some are benign false-positive traps a good analyst must clear.
#
#  DO NOT assume any indicator is malicious. Enrich EVERY one against trusted
#  threat-intelligence services and reach a sourced verdict before acting.
#
#  SAFETY: You will LOOK UP these indicators, not visit them. Never browse to a
#  suspected-malicious domain or download a suspected-malicious file to "check"
#  it. Enrichment services exist so you can assess without touching.
#
#  Lines beginning with # are comments. One indicator per line.
# =============================================================================

# ---- IPv4 ADDRESSES ---------------------------------------------------------
# (enrich with AbuseIPDB; cross-check high-suspicion IPs against Talos / OTX)
#
#   >>> INSTRUCTOR: replace the placeholders below with your chosen indicators
#   >>> before distributing. Verify each one's CURRENT enrichment result, as
#   >>> public reputation scores drift over time.
#
# EXAMPLE-IP-MALICIOUS-1        # planted known-bad (e.g., high-confidence AbuseIPDB scanner/abuse IP)
# EXAMPLE-IP-BENIGN-CDN         # benign trap (e.g., a major CDN / public DNS edge IP)

# ---- DOMAINS ----------------------------------------------------------------
# (enrich with VirusTotal Domains tab and/or Cisco Talos)
#
# EXAMPLE-DOMAIN-MALICIOUS      # planted known-bad (multi-engine / malware category)
# EXAMPLE-DOMAIN-BENIGN         # benign trap (top legitimate / trusted domain)

# ---- FILE HASHES (SHA-256) --------------------------------------------------
# (enrich with VirusTotal Files - search by hash, NEVER upload a file)
#
# The EICAR test file is the SAFE, STABLE "known-bad" anchor: every antivirus
# engine flags it, yet it is completely harmless. Its SHA-256 is fixed:
275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f   # EICAR test file - Malicious (High), stable anchor

# EXAMPLE-HASH-BENIGN           # benign trap (SHA-256 of a known-clean OS binary; VT shows 0 detections)

# =============================================================================
#  WORKFLOW
#    1. Sort these indicators by type into your SOC Engineering Notebook.
#    2. Enrich each against the appropriate service(s).
#    3. Record a verdict (Malicious / Suspicious / Benign) + confidence + source.
#    4. Explicitly CLEAR the benign traps - state what evidence cleared them.
#    5. Add ONLY High-confidence confirmed-malicious IPs to your Wazuh CDB list.
#    6. Produce the IOC report and the CDB detection rule (Lab 7, Parts 3-4).
# =============================================================================