N-IOCs to Rule Them All

What it is

DFIR research (FIRST Conference 2023) that reverse-engineers the forensic footprint of govcert.ch's top-ten Switzerland malware families (April–Dec 2022), deliberately ignoring the infection chain to focus on second-stage artifacts. The value it carries beyond the summary is the specific log sources, registry paths, event IDs, and Velociraptor hunts to check for each of the eight IOCs.

What to do

Concrete artifacts and collection methods the post specifies:

Defender exclusions (IOC #1) — Monitor Windows Defender event ID 5007 (records exclusion creation; also flags overly broad admin misconfigs). Or read exclusions directly from the registry where you have EDR/query code execution:

HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths

PowerShell (IOC #2) — Enable Script Block Logging via Group Policy network-wide (off by default; malware used PowerShell for persistence specifically to dodge EDR API hooks). Logs land in Microsoft-Windows-PowerShell. The author notes: check PowerShell logs during IR even when logging was never enabled globally — residual data often survives.

Scheduled tasks (IOC #3) — Run the built-in Velociraptor hunt Windows.System.TaskScheduler to collect tasks fleet-wide. Correlate with logs:

• Security.evtx: 4698 created, 4699 deleted, 4700 enabled, 4701 disabled, 4702 updated
• Microsoft-Windows-TaskScheduler%4Operational.evtx: 140 task updated, 141 task deleted

Run keys (IOC #4) — Monitor Sysmon event ID 13 (registry value set) for Run-key creation, or use Velociraptor to read Run keys across user and system hives, then filter with VQL (e.g. files under AppData).

Startup folder (IOC #5) — SysInternals AutoRuns, driven at scale through a Velociraptor network-wide hunt rather than per-host.

AppData (IOC #6) — Every family analyzed wrote to AppData\Local or Roaming at some point, so file-in-AppData is a broad catch-all to pivot on. (The fetched text truncates here; IOCs #7–#8 are named in the summary but not detailed in this excerpt.)

Preconditions

Most detections assume prior configuration: Script Block Logging and Defender event collection into a SIEM must be enabled before the incident, and the registry/AutoRuns approaches assume fleet-wide code execution (EDR or Velociraptor deployed).

Caveats

The author frames these as high-probability hunting signals, not deterministic detections — they generalize "probably" to strains beyond the ten studied, and each artifact is a persistence/evasion behavior a benign admin could also produce (notably the broad-exclusion and AppData cases). This is a threat-hunting and IR-triage aid, not a blocking control.