Cybersecurity glossary
What is an Indicator of Compromise (IOC)?
Learn what an Indicator of Compromise (IOC) is, how hashes, IPs, and domains are used in detection, why IOCs expire quickly, and how they differ from behavioral TTPs.
Definition
An Indicator of Compromise (IOC) is an observable artifact associated with malicious activity—such as a file hash, IP address, domain, URL, or certificate—that defenders can search for, block, or alert on to find related intrusions.
Why IOCs are fast—and fragile
When a sample lands, the first useful question is often “where else did this hash or domain appear?” An Indicator of Compromise (IOC) makes that search possible in minutes. The same speed is the weakness: adversaries rotate infrastructure faster than blocklists age.
Used well, IOCs buy time. Used as the only detection strategy, they train the SOC to chase yesterday’s campaign.
Common IOC classes
File and payload
Hashes, imphash, rich headers, and unique strings inside droppers—strong when rare, weak when packing changes every build.
Network and naming
IPs, domains, URLs, and JA3-like fingerprints. Easy to block, easy for attackers to replace, easy to collide with shared services.
Identity and mail
Sender addresses, reply-to domains, OAuth app IDs, and certificate serials tied to a specific intrusion set.
Host artifacts
Mutexes, named pipes, scheduled-task titles, and registry keys that survive a domain change.
A sane IOC lifecycle
Ingest with context
Source, confidence, first-seen, and related malware family—not a naked hash in a spreadsheet.
Score before you page
Decide block, alert, hunt, or ignore based on uniqueness and collision risk.
Match in the right layer
Email and DNS blocks for delivery IOCs; EDR for hashes; SIEM hunts for historical presence.
Expire aggressively
Set a review date. Shared IPs and parked domains should not live forever in production detections.
Graduate to behavior
If the same actor keeps returning, encode the TTP, not the fifth domain they registered this week.
IOC versus behavioral detection
| Approach | Catches well | Fails when |
|---|---|---|
| IOC match | Known samples, reused C2, shared tooling hashes | Infrastructure rotates or indicators collide with legitimate tenants |
| Behavioral TTP | Living-off-the-land and novel malware using known techniques | Telemetry is missing or the behavior is also normal admin work |
| Hybrid | Known bad plus suspicious chains involving those artifacts | Teams never expire the IOC half and drown in stale hits |
- Require confidence, source, and expiry on every indicator you operationalize.
- Prefer SHA-256 over MD5; still treat hashes as campaign-specific, not eternal.
- Do not auto-page the SOC on every threat-feed IP match.
- Hunt historically when a high-confidence IOC arrives, then decide on a standing alert.
- Watch for indicator collisions on CDNs, cloud NATs, and shared hosting.
- Keep victim-specific artifacts out of community shares.
- Pair blocks with detection so you learn when attackers switch infrastructure.
- Measure how many true incidents started from IOC hits versus behavioral rules.
The practical takeaway
An IOC is a perishable fingerprint, not a strategy. Use it to find related activity quickly, expire it on purpose, and invest the lasting detections in how adversaries behave after the hash changes.
Related security terms
Tactics, Techniques and Procedures (TTP)
Behavioral patterns that remain useful after individual IOCs rotate.
Threat Intelligence
Context that turns raw indicators into prioritized, attributed knowledge.
Detection Engineering
Decides when an IOC deserves a block, an alert, or only hunting.
Honeypot
Can generate high-confidence IOCs from attacker interaction.
Canary Token
A planted artifact whose use is itself a high-fidelity indicator.
Frequently asked questions
What is an IOC in simple terms?
It is a fingerprint left by an attack—a hash of malware, a command-and-control domain, or an IP the implant called—that you can look up in logs or block at the edge.
What are common IOC types?
File hashes (MD5, SHA-256), IP addresses, domains, URLs, email senders, mutex names, certificate serials, and sometimes unique registry keys or user-agent strings.
How is an IOC different from a TTP?
An IOC is a specific artifact. A TTP describes how the adversary operates (for example, using valid accounts and scheduled tasks). TTPs survive infrastructure rotation; IOCs often do not.
What is an Indicator of Attack (IOA)?
IOA usually refers to behavioral evidence of an attack in progress—suspicious process chains or privilege abuse—rather than a static hash. Definitions vary by vendor; prefer precise language.
Why do IOCs go stale?
Attackers change domains, IPs, and packers constantly. Shared hosting and CDNs also make yesterday’s “bad IP” today’s innocent tenant.
Should every IOC become a SIEM alert?
No. High-confidence, rare artifacts may alert. Noisy IPs should enrich or hunt. Blocking at DNS or email gateways is often better than paging the SOC for every hit.
How should IOCs be shared?
Use structured formats such as STIX/TAXII, include confidence, first-seen, and expiry, and never share victim-identifying data inside the indicator package.
References
Explore authoritative guidance and frameworks related to indicator of compromise (ioc).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.