Overview
Indicators of Compromise (IoCs) are the observable clues that a system may have been attacked or breached. They are the breadcrumbs defenders follow to detect intrusions and investigate incidents. This lesson explains what IoCs are, their types, and their limits.
Learning objectives
- Define an indicator of compromise.
- Distinguish IoCs from Indicators of Attack (IoAs).
- Recognize common IoC types and how they are used.
Core concept
An IoC is a piece of forensic evidence suggesting malicious activity — usually something that already happened. Common types:
- Network IoCs: connections to known-malicious IP addresses or domains, unusual traffic volumes or destinations.
- Host IoCs: unexpected new files, suspicious file hashes, unknown running processes, modified system files, new scheduled tasks.
- Account IoCs: logins at odd hours, from unusual locations, or many failed attempts followed by a success.
- Behavioral IoCs: a workstation suddenly scanning the internal network, or large data transfers to an external host.
A related idea, the Indicator of Attack (IoA), focuses on the behavior and intent in progress (e.g. "a process is trying to disable antivirus"), aiming to catch an attack as it unfolds rather than after.
How it works
Defenders collect IoCs from logs and endpoint tools, then match them against threat-intelligence feeds of known-bad indicators. A Security Information and Event Management (SIEM) system centralizes logs so analysts can search for and correlate IoCs across many systems. Sharing IoCs (via standards like STIX/TAXII) lets organizations warn each other quickly.
Practical example
An analyst notices a workstation making repeated outbound connections to an unfamiliar domain at 3 a.m., alongside a new process with a suspicious hash. Cross-referencing threat intel confirms the domain is a known malware command-and-control server. Those matched IoCs trigger an investigation and containment — isolating the host before data leaves.
Cybersecurity relevance
IoCs are the daily bread of the SOC & Blue Team path. But note their limit: IoCs are often reactive — they describe attacks already seen elsewhere. Sophisticated actors change infrastructure constantly, so relying only on known IoCs misses novel attacks. That is why behavior-based detection (IoAs) complements them.
Common mistakes
- Treating a single IoC as proof. Indicators can be false positives; they warrant investigation, not blind reaction.
- Relying solely on known-bad lists, which miss new or targeted attacks.
- Not centralizing logs, making cross-system correlation impossible.
Key takeaways
- IoCs are observable clues that a compromise occurred; IoAs focus on attacker behavior in progress.
- Types span network, host, account, and behavioral indicators.
- IoCs power detection and threat sharing but are partly reactive, so behavior-based detection is needed too.
Check your understanding
- Give one network IoC and one host IoC you might see during a malware infection.
- Why is relying only on known-bad IoC lists insufficient against a sophisticated attacker?