Indicator of compromise: definition

An indicator of compromise (IOC) is evidence left behind by an attack: the hash of a malware file, the domain it contacts, the IP address of a command-and-control server, a suspicious scheduled task name. Threat intelligence reports and incident write-ups usually end with a list of IOCs so that other organizations can check whether they were hit by the same campaign.

Example

A threat report says a phishing campaign used the domain login-micros0ft[.]com and a payload with a specific SHA-256 hash. You search your proxy, DNS and endpoint logs for both values over the last 30 days. A match on either one means you need to investigate the affected users and devices.

Why it matters for a SOC analyst

IOCs are fast to search and easy to share, but they are also easy for attackers to change: a new domain costs a few dollars, a recompiled file has a new hash. Treat IOC matches as strong leads, and complement them with behavior-based detections, which focus on how attackers operate rather than on the specific tools they used last time.

Related terms

Threat intelligence

Information about threats and threat actors, collected and analyzed so that an organization can make better security decisions.

Tactics, techniques and procedures

How an attacker operates: the goal of each step (tactic), the method used to reach it (technique) and the specific way it is carried out (procedure).

Command and control

The channel attackers use to communicate with compromised systems: sending commands, receiving stolen data and delivering new tools.

SIEM

A platform that collects logs from across an organization, correlates them and raises alerts, giving the SOC one place to investigate.

EDR

Security software on laptops and servers that records process, file and network activity, detects malicious behavior and lets analysts respond.

Lateral movement

The techniques attackers use to move from the first compromised system to other systems and accounts inside a network.