Indicators of Compromise (IoC)

Indicators of Compromise (IoCs) are pieces of forensic data — artifacts found on networks, systems, or in logs — that indicate a potential intrusion or that malicious activity has occurred. They serve as "breadcrumbs" that security teams use to detect, investigate, and respond to incidents.\n\nCommon IoCs include known malicious IP addresses and domains, file hashes of malware samples, suspicious registry keys, unusual network traffic patterns, and specific strings in log files. More advanced Indicators of Attack (IoAs) focus on attacker behavior patterns rather than static artifacts, making them more resilient to obfuscation.\n\nThreat intelligence platforms aggregate and share IoCs across organizations and industries, enabling rapid dissemination of attack signatures. However, IoCs have a limited shelf life — sophisticated attackers regularly rotate infrastructure and recompile malware to avoid detection based on static indicators.