Security Operations · Foundational

Indicator of Compromise (IoC)

Forensic evidence that a system or network has likely been breached, such as malicious hashes, IPs, domains or registry keys.

Definition

IoCs are artifacts observed after or during an intrusion and are used to detect, block and scope incidents. They include file hashes, IP addresses, domain names, URLs, email addresses, mutexes, registry keys and unusual processes. IoCs are reactive and change easily, so they sit low on the Pyramid of Pain.

Don't confuse it with

Related terms