An indicator of compromise (IoC) is a piece of forensic evidence – such as a file hash, IP address or domain – that suggests a system has been attacked or infected.
Types of IoCs
- file indicators – hashes (MD5, SHA-1, SHA-256), file names and paths of malware;
- network indicators – IP addresses, domains and URLs of command and control servers, phishing sites and download servers;
- host indicators – registry keys, services, scheduled tasks, mutexes created by malware;
- email indicators – sender addresses, subjects, attachment names.
IoCs are published in threat reports and security advisories, shared through threat intelligence platforms such as MISP in the STIX/TAXII formats, and turned into detection rules for SIEM, EDR and firewalls. YARA rules describe patterns in files rather than single hashes.
Why IoCs matter for security
IoCs let organizations quickly check whether a known campaign has reached them and block it: after a new report, a SOC can search months of logs for the listed domains and hashes. Their weakness is that they are easy to change. David Bianco’s “Pyramid of Pain” (2013) shows this: changing a hash or IP costs attackers nothing, while changing their tools and techniques (TTPs) is expensive. That is why defenders complement IoCs with indicators of attack – behaviour patterns that stay the same when the infrastructure changes.
How to use IoCs
- Automate ingestion of trusted feeds and remove outdated indicators to avoid false positives.
- Search historical logs, not just new traffic – the attack may have happened earlier.
- Document the IoCs of your own incidents and share them with partners and CERTs.
