IoC (Indicator of Compromise) Investigation - Instructions

Purpose

This skill performs comprehensive security investigations on Indicators of Compromise (IoCs) including:

• IP Addresses: Network connections, threat intel matches, geographic analysis, organizational exposure
• DNS Domains: Domain reputation, connection events, email-based threats, URL analysis
• URLs: URL reputation, phishing detection, email delivery, browser activity
• File Hashes: Malware analysis, file prevalence, related alerts, affected devices

The investigation correlates IoCs with Microsoft Defender Threat Intelligence, identifies associated CVEs, and enumerates organizational assets affected by those vulnerabilities.

📑 TABLE OF CONTENTS