Indicators of Compromise (IOCs) allow security teams to **identify, track, and block known threats** in CrowdStrike Falcon. By creating custom IOCs, administrators can proactively defend against **specific malicious files, domains, or IP addresses**.
This guide explains how to create and manage **custom IOCs** in the **CrowdStrike Falcon Console**.
---Step 1: Log Into the Falcon Console
- - Open a browser and go to the CrowdStrike console. There are two possibilities (Will depend on your tenant):
-
Sign in using your admin credentials
Step 2: Navigate to the IOC Management Page
- - In the **left-hand menu**, click **Threat Intelligence** > **IOC Management**.
- You will see a list of **existing IOCs**.
Step 3: Add a Custom IOC
Option 1: Create a File Hash IOC
To block or track a specific file:
- - Click **Add IOC** > **File Hash**.
- Enter the **SHA256, SHA1, or MD5 hash** of the file.
- Choose an **Action**:
-
Detect Only – Flag detections but allow the file to execute.
-
Detect & Prevent – Block execution immediately.
-
Assign Severity Level (Low, Medium, High, or Critical).
-
Add a Description (e.g., “Known Ransomware Sample”).
-
Click Save.
Option 2: Create a Domain or IP IOC
To block access to a malicious domain or IP address:
- - Click **Add IOC** > **Domain or IP**.
- Enter the **malicious domain (e.g., badsite.com) or IP address**.
- Set the **Action**:
-
Detect Only – Flag detections without blocking.
-
Detect & Prevent – Block all connections to this domain/IP.
-
Click Save.
Step 4: Assign IOCs to a Prevention Policy
- - Navigate to **Configuration** > **Prevention Policies**.
- Select a policy (e.g., **Standard, High Security, Custom**).
- Click **Edit Policy** and go to **Custom IOCs**.
- Click **Add IOC** and select the newly created IOCs.
- Click **Save and Apply Policy**.
Step 5: Monitor IOC Activity
- - Go to **Activity** > **Detection Summary**.
- Filter results by **IOC Name** to see if the indicator has been triggered.
- Adjust IOC actions if needed based on real-world detections.
Best Practices for Custom IOCs
✅ **Use File Hashes for Known Malware** – Avoid using partial hashes that could match legitimate files.
✅ **Be Careful with Domain/IP Blocking** – Ensure that blocking a domain/IP won’t impact legitimate services.
✅ **Review IOCs Regularly** – Remove outdated IOCs to prevent unnecessary detections.