IOCs

Indicators of Compromise (IOCs) are artifacts observed on a network or in an operating system that indicate a potential security breach or malicious activity. They provide actionable data used to detect intrusions, investigate incidents, and guide incident response. IOCs do not prove wrongdoing by themselves; they signal anomalies that require contextual analysis.

IOCs come in several forms. Network IOCs include IP addresses, domain names, URLs, and observed ports associated with malicious infrastructure or command-and-control activity. Host-based IOCs include file hashes (MD5, SHA-1, SHA-256), filenames, file paths, digital signatures, registry keys, mutex names, and other artefacts created by malware. IOCs can also encompass behavioral indicators such as unusual process creation or unexpected privilege changes.

Security teams utilize IOCs by feeding them into tooling such as SIEMs, intrusion detection systems (IDS), endpoint detection and response (EDR) platforms, and threat intelligence feeds. IOCs can be static, tied to a specific malware sample or campaign, or dynamic, refreshed as threat actors evolve their tools. They are often analyzed alongside tactics, techniques, and procedures (TTPs) to provide richer context and improve triage.

Limitations include the potential for false positives and the fact that IOCs can become stale as adversaries rotate infrastructure. A robust defense treats IOCs as signals within a broader analytic workflow, corroborating them with behavioral data, anomaly detection, and incident context.

Standards and sharing practices help scale IOC use. Formats such as STIX (Structured Threat Information Expression) and TAXII (Trusted Automated Exchange of Indicator Information) facilitate machine-readable exchange, while OpenIOC and other schemas offer alternative approaches. Effective IOC programs emphasize provenance, confidence levels, and lifecycle management, and are often integrated with MITRE ATT&CK mappings.