Indicators and ICS Network Defense

This blog post examines the debate between IOC-driven and behavioral (IOC-less) threat intelligence reporting in the context of ICS defense, using Dragos' work on the XENOTIME/TRISIS activity as a case study; the author argues that omitting IOCs can be appropriate depending on the audience and operational usefulness, while acknowledging concerns that IOC omission might disadvantage defenders if actionable context is lacking.