Why Detecting Behaviors, Not IOCs, Beats Zero-Days

Blumira first detected and alerted on the MOVEit exploitation of CVE-2023-34362 on May 28th, 2023 — three days ahead of the MOVEit vulnerability announcement, allowing the customer to quickly respond.Detecting on behaviors (TTPs) rather than on specific indicators of compromise (IOCs) alone such as file hashes, IP addresses, or domain names is a no brainer.

Since attackers can easily swap out their IOCs, it’s more difficult for defenders to detect them.While it’s fairly simple for attackers to hide from AV …

addresses announcement blumira compromise customer cve cve-2023-34362 cybersecurity domain domain names exploitation file hashes indicators of compromise iocs ip addresses may moveit names quickly respond ttps vulnerability zero-days