Lion Cipher Lab
Pivot on indicators of compromise (IOCs) with VirusTotal and OTX
- Threat Intel Analyst
- Beginner
- ~45 min
- Free · no account required
Why it matters
Real defensive work almost never starts with a full picture — it starts with a single loose thread. An alert fires on one file hash. A phishing email came from one domain. A firewall logged one suspicious IP. The skill that turns that one thread into an understanding of the threat is called pivoting: taking a known indicator and asking free intelligence sources what else is connected to it, then following those connections outward. VirusTotal and AlienVault OTX are the two most widely used free platforms for exactly this, and analysts on real security teams open them dozens of times a day.…
What you'll learn
- reading a VirusTotal report for a file hash, a domain, and an IP address
- pivoting from one indicator to related ones (the Relations and Details tabs)
- understanding passive DNS, WHOIS, and resolutions as pivot points
- using AlienVault OTX pulses to see who has already reported an indicator
- defanging indicators (hxxp://, 1.1.1[.]1) so nothing is ever clicked by accident
- assembling several enriched indicators into a small picture of an actor's infrastructure
Steps in this lab
- The words first: IOC, hash, pivot, enrichment
- The safety rules for this lab (read before anything else)
- Make your free accounts: VirusTotal and OTX
- Read your first report: paste the safe hash into VirusTotal
- The pivot: the Relations tab turns one indicator into many
- Pivot on a domain: resolutions, passive DNS, and WHOIS
- Cross-check in OTX: who has already reported this?
- Assemble the picture: from a pile of indicators to an actor's infrastructure
- Why this reflex is worth building