IOC (Indicator of Compromise)

Why it matters

IOCs are the currency of incident response and threat intelligence. A vendor report, a CERT advisory or a colleague's e-mail says "we saw evil-cdn[.]example and SHA-256 3a7f…"; you search your logs and endpoints for the same values, and either you are clean or you have a second incident. The whole sharing ecosystem — STIX/TAXII, MISP, ISACs, the blocklists your firewall pulls — exists to move these values from the first victim to everyone else faster than the attacker moves.

Their weakness is the flip side: an IOC describes one past instance of an attack. Change the hash by recompiling, the IP by renting a new VPS, and the indicator is dead. That is the point of David Bianco's Pyramid of Pain: hash values (trivial for the attacker to change) at the bottom, then IP addresses (easy), domain names (simple), network and host artefacts (annoying), tools (challenging) and at the top TTPs (tough) — behaviours the attacker cannot change without changing how they work. Detections built on the top of the pyramid outlive the campaign.

Kinds of indicator, and defanging

Atomic indicators stand alone: IPv4/IPv6 addresses, domains, URLs, e-mail addresses, file hashes (MD5, SHA-1, SHA-256), file names and paths, registry keys, mutex names, certificate fingerprints. Computed indicators are derived from data (a fuzzy hash, a JA3/JA4 TLS fingerprint, a YARA match). Behavioural indicators are patterns of the first two — at which point they shade into IOAs.

Every IOC needs context to be useful: where it was seen, when, in which campaign, how confident the source is, and a TLP (Traffic Light Protocol) marking saying who may see it — TLP:CLEAR, GREEN, AMBER, AMBER+STRICT, RED. An IP address that was malicious last Tuesday and is a shared cloud load balancer today is the classic false positive; expiry dates matter.

Defanging is the convention for writing indicators so that they cannot be accidentally clicked, auto-linked or fetched by a mail client, a chat tool or a ticketing system's link preview: http://evil.example.com/x becomes hxxp://evil[.]example[.]com/x, 203.0.113.7 becomes 203[.]0[.]113[.]7, user@evil.example becomes user[@]evil[.]example. Refanging reverses it before the value goes into a search or a blocklist. Reports and tickets should carry defanged values; tooling should refang on input.

Common misreadings

• Presence ≠ compromise. A DNS lookup of a bad domain by a security scanner, a hash of a legitimate tool the attacker also uses (PsExec), an IP shared by a CDN: verify before declaring.
• IOCs age. Feeds without expiry produce blocklists that grow forever and block last year's cloud IPs. Prefer sources that carry valid_from/valid_until.
• Your own IOCs are personal data. Attacker e-mail addresses and IPs fall under the GDPR; sharing them for security is lawful, keeping them forever is not.

Related terms

• IOA — An IOA describes what an attacker is doing rather than what they left behind — a sequence of actions such as "a document opens a shell that downloads and executes a file" — so it detects the technique regardless of which hash, IP or domain is used this time.
• TTP — TTPs are the three levels at which attacker behaviour is described — the tactic is why (steal credentials), the technique is how (dump LSASS memory), the procedure is exactly how this actor does it (procdump renamed to dump64.exe, run via a scheduled task).
• STIX / TAXII — STIX is the standard JSON format for describing threat intelligence — indicators, malware, attack patterns and how they relate — and TAXII is the HTTPS protocol for publishing and pulling STIX between organisations and tools.
• MITRE ATT&CK — MITRE ATT&CK is a public, curated catalogue of the behaviours real attackers use, organised so defenders can say "we saw T1059.001" instead of "some PowerShell thing".
• CIDR — CIDR notation writes an IP range as an address plus a prefix length — 10.20.30.0/26 — where the number after the slash says how many leading bits are the network and therefore how many addresses the block contains.