Indicators of Compromise - Reyhford Threat Intelligence

An Indicator of Compromise (IoC) is an observable that suggests malicious or suspicious activity — typically IPs, domains, hashes, or URLs. In Reyhford’s domain, IoCs are usually source IPs (and related metadata) that probed or attacked ICS honeypots.

IoCs in an OT context

Traditional IT IoCs often mean “this host was seen in malware C2.” ICS honeypot IoCs more often mean:

Internet-wide industrial scanning
Targeted reconnaissance against Modbus/S7/BACnet/IEC 104/EtherNet/IP/ATG
Write or command attempts against emulated controllers

That is still actionable: blocklists, firewall rules, CERT advisories, and hunting queries for the same sources on your perimeter.

What we attach to each IoC

Through enrichment, Reyhford indicators may include:

Protocol / port context
MITRE ATT&CK for ICS technique tags
Confidence score
Sensor / region of observation
Timestamps for first/last seen style analytics

How to use them

Role	Use
SOC L2/L3	Hunt + block; correlate with VPN/firewall
CISO	Brief risk with protocol + region context
National CERT	Sector advisories; share via TAXII peers

See STIX 2.1 and Confidence scoring.