What Is an Indicator of Compromise (IOC)?
An indicator of compromise (IOC) is a piece of forensic evidence that suggests a system has been — or is being — breached. A malicious file hash, a connection to a known-bad server, a suspicious scheduled task: each is a clue. Defenders collect IOCs from threat intelligence and their own investigations, then hunt for them across their environment to detect and scope attacks.
What do IOCs look like?#
They span the layers an attacker touches:
| Category | Examples |
|---|---|
| File-based | Malicious hashes, filenames, certificates |
| Network | Bad IPs, domains, URLs, JA3 fingerprints |
| Host | Registry keys, mutexes, scheduled tasks |
| Account | Impossible-travel logins, privilege changes |
Feeding known-bad IOCs into a SIEM or EDR lets defenders ask: has anything in our network touched these? A match is a strong signal to investigate.
Why are IOCs not enough on their own?#
Because they describe known threats after the fact. An IOC is only useful once someone, somewhere, has already seen that hash or domain — so IOCs miss novel attacks and are easily evaded by changing a file or rotating infrastructure. This is why modern detection also looks at indicators of attack (IOAs) — attacker behavior mapped to MITRE ATT&CK, which survives cosmetic changes.
IOCs are the raw material of detection and threat intelligence. More at the Security Fundamentals hub.
Frequently asked questions#
What is an indicator of compromise?
An indicator of compromise (IOC) is a piece of forensic evidence suggesting a system may have been breached — a malicious file hash, a known-bad IP or domain, an unusual registry key, or anomalous account activity. Defenders match IOCs against their logs and systems to detect known threats and scope incidents.
What is the difference between an IOC and an IOA?
An indicator of compromise (IOC) is evidence that an attack already happened — artifacts left behind. An indicator of attack (IOA) focuses on behavior in progress, like the sequence of actions an attacker takes, regardless of the specific tools. IOAs catch novel threats; IOCs catch known ones.