What is Indicators of Compromise (IOC)?
Indicators of Compromise (IOC) is a piece of forensic evidence, such as a file hash, IP address, domain name, or registry key, that signals a system has been breached or targeted. Security teams collect and share IOCs to detect known threats, block malicious infrastructure, and investigate incidents.
What it is
An IOC is an artifact left behind by an attacker or malicious tool. Common IOC types include:
- File hashes (MD5, SHA-256): fingerprints of malware samples
- IP addresses: command-and-control servers or scanning sources
- Domain names: phishing sites or malware delivery hosts
- URLs: specific malicious endpoints
- Email addresses or subjects: used in phishing campaigns
- Registry keys or file paths: persistence mechanisms on Windows hosts
- User-agent strings: patterns in HTTP traffic tied to known attack tools
IOCs are typically expressed in structured formats such as STIX (Structured Threat Information Expression) or OpenIOC so that tools can parse and act on them automatically.
Why it matters
IOCs give defenders a concrete, machine-readable way to answer the question: "Has this threat touched my environment?" A single confirmed IOC, such as a known ransomware hash found on a workstation, can trigger an incident response process. Sharing IOCs across organizations speeds up detection because one victim's discovery becomes another organization's early warning. Threat Intel Platforms and Threat Intel Feeds are the primary channels through which IOCs are collected, enriched, and distributed.
How tools address it
Threat Intel Platforms ingest IOCs from commercial feeds, open-source lists, and internal telemetry. They enrich raw artifacts with context: who operates a given IP, which threat actor group uses a particular domain, and how recently the indicator was seen active. Tools like those in the Threat Intel Platforms category can search historical DNS and WHOIS records to trace infrastructure, look up compromised credentials tied to a domain, or map relationships between IOCs using graph visualizations. Security teams then push confirmed IOCs into SIEMs, firewalls, and endpoint tools for automated blocking or alerting.