Indicators of compromise (IOC)
Also known as: IOC, IOCs, indicator of compromise
Indicators of compromise (IOCs) are pieces of evidence that suggest a system or network has been breached, such as a known malicious IP address, a file's unique hash, a suspicious domain name, or an unusual registry change.
Security tools search for IOCs to detect attacks and to check whether a known threat has reached an organization. While IOCs are useful for quick detection, attackers change them easily, so they work best alongside detection of attacker behaviour.
Indicators of compromise (IOC), explained at three levels
At home
Indicators of compromise are like fingerprints and footprints left at a crime scene. When investigators study an attack, they record its traces, such as a web address the malware contacts or a unique fingerprint of the malicious file, called a hash. Security software on your computer compares what it sees against those lists, and a match suggests the same attacker has been there.
At work
Indicators of compromise are technical clues that a system may have been breached, such as a known malicious IP address, a suspicious domain, or the hash of a malware file. Security teams load them into their tools to block known threats and search past logs for matches. For a business, they offer a fast way to answer one question: has this known attack reached us?
At home
An IOC is a fingerprint left behind by a known attack. If investigators find that a piece of malware always contacts a certain web address, or always has the same file fingerprint, called a hash, they publish those details. Security software then compares what is happening on your computer against these lists. If a file's hash matches, or your computer tries to reach a listed address, the software blocks it and raises an alert.
At work
IOCs range from easy to hard for attackers to change, a ranking known as the Pyramid of Pain. File hashes and IP addresses sit at the bottom, since one recompile or new server defeats them. Domains and network artefacts sit higher, and attacker tools and behaviour sit at the top. Teams load indicators into SIEM, EDR, firewalls and DNS filters, and also search past logs, a step called retro-hunting, to see whether the threat was already inside.
At home
While IOC lists are useful, criminals change their files and addresses constantly, sometimes for every single victim. A brand-new variant has a hash no list has seen, so matching alone misses it. That is why modern security software also watches what a program does, such as encrypting many files in a row, rather than only what it is. In my view, behaviour-based protection is the part that does the heavy lifting against new threats at home.
At work
Indicators lose value quickly and generate false positives, especially for shared infrastructure such as cloud hosting and content delivery networks, where one IP serves thousands of legitimate sites. Manage them with source, confidence, first-seen dates and expiry, and prefer matching on context, such as a domain plus a process name. Pair IOCs with indicators of attack, which describe behaviour like credential dumping or unusual parent and child processes, mapped to MITRE ATT&CK. Retro-hunting across retained logs turns a new indicator into proof of whether you were hit.
Real-world examples
At home
Carlos's antivirus flagged a file in his downloads folder. The file's hash matched a known IOC for password-stealing malware, so the software quarantined it.
At work
Sophie is a SOC analyst at a Vancouver logistics company. When a government advisory listed IOCs for a new ransomware campaign, she searched three months of logs to confirm none had appeared on the network.
How it compares
| feature | Indicators of compromise (IOC) | Indicators of attack (IOA) |
|---|---|---|
| What it shows | Evidence a breach happened | Behaviour suggesting an attack in progress |
| Examples | Malicious IP, file hash, domain | Unusual login patterns, credential dumping |
| Ease for attackers to change | Easy | Harder |
| Best use | Fast checks and blocking | Catching new threats |
IOCs show where attackers have been. IOAs show what they're doing.
For analysts
When a government advisory lists IOCs relevant to your industry, I'd have IT search historic logs, not just block them going forward. Finding an old intrusion early limits the damage.
History & origin
Investigators have always used clues to trace intrusions, but sharing them in standard formats took off in the 2010s. Mandiant released hundreds of IOCs alongside its 2013 APT1 report and promoted the OpenIOC format. The STIX language and TAXII protocol, developed with US government support and later managed by the OASIS standards body, became the common way to exchange indicators. Security researcher David Bianco's 'Pyramid of Pain' in 2013 argued that simple indicators like IP addresses are trivial for attackers to change, while behaviours are much harder. Government agencies, including the Canadian Centre for Cyber Security, regularly publish IOCs in joint advisories. In my view, IOCs are a smoke alarm, not a fire investigation: useful for alerting, never the whole story.