What is an Indicator of Compromise (IOC)?
An Indicator of Compromise (IOC) is a piece of forensic evidence that suggests a system or network may have been breached. IOCs are often described as the digital fingerprints an attacker leaves behind, the clues that confirm someone was, or still is, in the environment. Security teams collect them during and after an incident and then reuse them to detect the same threat elsewhere.
What are common examples of IOCs?
- Malicious IP addresses and domains: Known bad infrastructure that systems are communicating with.
- Suspicious file hashes: Unique signatures of known malware files.
- Unusual network traffic: Unexpected outbound connections or large transfers to unfamiliar destinations.
- Anomalous logins: Sign-ins from abnormal locations or after many failed attempts.
- Unauthorized system changes: New accounts, unexpected software installs, or altered files and registry settings.
How do security teams use IOCs?
- Detection: Feeding IOCs into tools like SIEM and EDR so matching activity raises an alert.
- Investigation: Using them during incident response to understand what happened and how far the damage spread.
- Threat sweeping: Searching the wider environment to see if the same attacker has been active on other systems.
What is the difference between an IOC and an IOA?
- IOC (Indicator of Compromise): Reactive and retrospective. It answers the question “what happened?” by examining evidence after a breach.
- IOA (Indicator of Attack): Proactive and behavioral. It answers “what is happening now?” by spotting attacker activity as it unfolds.
- Used together: SOC and MDR teams rely on both, combining forensic evidence with real-time behavior for fuller coverage.
What are the limits of IOCs?
- They are reactive: Finding an IOC usually means a compromise has already occurred.
- They can be evaded: Attackers easily change IPs, domains, and file hashes to avoid known indicators.
- They are strongest when paired: Combining IOCs with behavioral analysis catches both known threats and new attacks that no indicator exists for yet.
