Glossary · simply explained

IoC (Indicators of Compromise)

IoCs are traces of an attack: hashes, domains, IP addresses. Valuable for hunting — but quickly outdated.

Indicators of compromise (IoCs) are observable traces that point to a compromise: file hashes of known malware, command-and-control domains, suspicious IP addresses, characteristic registry entries or mutex names.

IoCs are the currency of the threat intelligence world: feeds and reports deliver them, security tools match environment and logs against them. Their value is real — but limited, because attackers rotate infrastructure and tools quickly.

How do you work with IoCs?

Two directions: retrospectively, the estate is searched — do the hashes, domains or IPs from a current report appear in our logs of recent months? Prospectively, IoCs flow into blocklists and detection rules so that future contacts stand out immediately.

The limit is described by the pyramid of pain: hashes and IPs are trivial for an attacker to change, domains take little effort — behaviours (TTPs, see MITRE ATT&CK) only at real cost. Mature detection therefore relies on behaviour and uses IoCs as a fast but fleeting complement.

Typical IoC categories

File indicators: hashes, file names, paths, signature features.
Network indicators: domains, IP addresses, URLs, certificate fingerprints.
Host indicators: registry keys, services, scheduled tasks, mutexes.
Behaviour-adjacent indicators: characteristic command lines or sequences.

Frequently asked questions about IoC (Indicators of Compromise)

Where do IoCs come from?

From threat intelligence feeds (commercial and open), vendor reports, CERT advisories, industry sharing groups — and from your own incidents: every incident response produces indicators that sharpen future detection.

Why do IoCs age so quickly?

Because attackers change the underlying artefacts cheaply: a new compilation changes the hash, new domains cost cents, cloud IPs rotate anyway. Hence: use IoCs for fast matching, base long-term detection on behaviour.

What is the difference between IoC and IoA?

IoCs prove something happened — traces after the fact. Indicators of attack (IoAs) describe ongoing attack behaviour, such as suspicious process chains, independent of known artefacts. IoAs also detect the new, IoCs only the known.

How do I check my environment against IoCs?

Via SIEM or EDR searches against historical logs (retro hunting) and via automatic feeds into firewalls, DNS filters and endpoint protection. The retrospective matters: a new report should always trigger the question of whether the indicators appeared with us before.

What is the pyramid of pain?

A model that orders indicators by how much their detection hurts the attacker: hashes and IPs at the bottom (trivial to change), domains and artefacts in the middle, tools and behaviour patterns at the top. The higher the level, the more durable the detection.