Campaigns

A campaign is a planned sequence of malicious actions executed by a threat actor over time to accomplish a specific goal, such as system disruption or financial gain.

Indicators of Compromise (IOCs) are pieces of evidence that suggest a system, network, or domain may have been breached or compromised by a cyberattack.

IOCs act as early warning signals, enabling organisations to detect, investigate, and respond to threats. However, IOCs are inherently volatile, as adversaries frequently modify or abandon them to evade detection, requiring continuous monitoring and intelligence updates to maintain their effectiveness.

Each IOC has a decay score, a dynamic model that measures the diminishing relevance of IOCs over time. This scoring reflects the reality that threat actors often abandon or rotate infrastructure after detection, exposure, or operational shifts. By applying a decay score, organizations can prioritize threat intelligence efforts by focusing on active, high-risk IOCs while deprecating outdated or less relevant ones.

When Rapid7 Labs identifies malicious IP addresses or URLs linked to threat actor campaigns, these indicators are initially assigned a high-confidence score, up to the maximum possible score of 100 for the highest-risk IOCs. Over a predefined period, typically 60 days, this score gradually decreases daily until it reaches 0, signifying that the indicator has transitioned from actively malicious to a status of historically malicious.

However, if renewed malicious activity involving the same indicator is detected during this decay period, the indicator’s decay score resets back to its initial high-confidence score, restarting the decay cycle.

Benefits of decay scores include:

• Reducing false positives by ensuring outdated IOCs do not linger indefinitely in active blocklists.
• Allowing security teams to prioritize fresh, relevant threats.
• Optimizing resource allocation by preventing unnecessary investigations into obsolete indicators.

Common vulnerabilities and exposures (CVEs) are publicly known cybersecurity vulnerabilities.

Each CVE is assigned a standardized identifier which typically follows the format CVE-[year]-[identifier number], for example, CVE-2023-23397 (a Microsoft Outlook Elevation of Privilege vulnerability).

CVEs enable consistent communication and referencing of vulnerabilities, helping security teams track, assess, and remediate issues across different systems and software.

When a CVE appears in a threat actor or campaign profile, it indicates that the vulnerability has been observed or reported as exploited by the threat actor or leveraged in a malicious operation.

A registry path is a specific location in the Windows Registry, which is a hierarchical database that stores system and application settings.

Threat actors commonly use registry paths to maintain persistence, store malicious configurations, or execute payloads. Similar to a file path, it defines where configuration data is stored and accessed by the Windows operating system and software to function properly. However, threat actors frequently abuse the Windows Registry for malicious purposes, such as establishing persistence, evading detection, or disabling security features. By modifying or creating registry keys, attackers can execute malware at startup, disable security tools, or manipulate system behavior to maintain access and control over a compromised system.

A script refers to a sequence of commands executed within a system’s command-line interface (CLI) or shell environment, often used by administrators or automated processes to perform routine or complex tasks. However, scripts are also frequently leveraged by threat actors to execute malicious actions such as persistence, lateral movement, reconnaissance, credential dumping, or command and control (C2) communication.

Scripts are key indicators of attacker activity, as they often reveal the specific tactics, techniques, and procedures (TTPs) used during an intrusion.

In cybersecurity analysis, suspicious or malicious scripts are identified by detecting specific command patterns, encoded payloads, suspicious arguments, or unexpected executions that deviate from normal administrative usage.

Examples:

• Malicious PowerShell script used to download and execute remote payloads:

  powershell.exe -nop -exec bypass -enc [encoded_payload]

• Suspicious command line to disable security features:

  netsh advfirewall set allprofiles state off

Hunting rules are used to proactively identify suspicious or malicious activity in your environment, based on known patterns, behaviours, or indicators.

There are two types of hunting rule:

Hunting rules enable proactive threat identification, TTP-based detection, and forensic investigations before an IOC-based alert is triggered.

Detection Rules are the logic SIEM (InsightIDR) uses to identify suspicious attacker activity and anomalous user behaviors within your environment. These rules continuously analyze activity data collected by SIEM (InsightIDR), leveraging predefined conditions based on attacker TTPs, IOCs, or behavioral anomalies.

When the conditions defined by a detection rule are satisfied, SIEM (InsightIDR) triggers a detection event, alerting your security team to investigate promptly.

Note: Detection Rules are available exclusively to customers using both Threat Intelligence (Intelligence Hub) and SIEM (InsightIDR).

For detailed reference and consistency, please visit the official documentation: SIEM (InsightIDR) Detection Rules .