Indicator of Compromise (IOC)

IOCs are observable artifacts tied to an attacker or their activity, including their tactics, techniques, and procedures (TTPs) and the tools and infrastructure they use. They can be observed on the network or on an endpoint. Examples include IPv4 and IPv6 addresses and domain names in network traffic, TLS certificate details, code-signing certificates in binaries, and cryptographic hashes of malicious binaries or scripts.

Defenders load IOCs into firewalls and other security control points, which then search the traffic they monitor for them. Intrusion detection and prevention systems use IOCs, antivirus and EDR products push them to endpoints, and SIEM platforms compare them against aggregated logs. A match can block malicious traffic or code, show that an intrusion took place, or link activity to a known intrusion set. IOCs are short pieces of text that are easy to share, and standard formats exist for exchanging large sets of them with their context. An IOC without context, such as the threat actor it relates to or when it was last seen in use, is of little use for defense.

IOC types differ in how hard they are for an attacker to change, a ranking known as the pyramid of pain. File hashes at the bottom are precise, but an attacker only needs to recompile the code to change one. IP addresses and domain names cost more to change. Tools and TTPs at the top are the hardest for an attacker to change and take the most effort for a defender to detect. An IOC stops being useful when the attacker's TTPs shift or the defender remediates, and defenders should then remove it from detection to reduce false positives.