What is an indicator of compromise?
An indicator of compromise, or IoC, is a piece of observable evidence that a system or network has been breached. It is something an analyst can record, share and search for: a file hash, an IP address, a domain name, a registry key, a process, a log entry or a pattern of behavior. Security teams use IoCs to detect intrusions, scope how far one has spread and block the attacker's infrastructure. Threat intelligence feeds and government advisories publish IoCs so other organizations can check whether the same attacker has reached them.
Types of indicators
Atomic indicators are single artifacts:
- File hashes, ideally SHA-256, of known malware
- IP addresses and domains used for command and control or data exfiltration
- Malicious processes, judged by their name, path, parent process and signature
- File-system and registry artifacts, such as dropped files, new services, scheduled tasks and run keys
- Plaintext strings in a binary, such as a hardcoded domain
Behavioral indicators are patterns that deviate from a baseline: account lockouts, impossible travel between sign-ins, concurrent sessions, missing or cleared logs and unusual resource consumption. A hash is precise but changes the moment the attacker alters one byte; an IP address or domain is cheap to replace; behavior is the hardest for an attacker to change. This idea is often drawn as the Pyramid of Pain, with hashes at the bottom and attacker techniques at the top.
An IoC example
A threat advisory lists a SHA-256 hash, a domain registered three days earlier and an IP address. An analyst searches EDR, DNS and proxy logs and finds the hash on two finance workstations, both resolving the domain and connecting to the IP every 60 seconds. One indicator alone could be a false positive, but several independent indicators that agree justify isolating the hosts, preserving evidence and blocking the domain and IP at the perimeter.
How IoCs are shared and used
Structured Threat Information Expression (STIX) is a standard format for describing indicators and the threats they relate to, and Trusted Automated Exchange of Intelligence Information (TAXII) is the protocol for exchanging them over HTTPS. Organizations load IoCs into the SIEM, EDR, firewalls and DNS filters as detection and blocking rules, and use them in threat hunts. Indicators expire, since attackers rotate infrastructure and recompile malware, so feeds must stay current and old indicators must be retired.
IoC vs. indicator of attack vs. precursor
An IoC shows that a compromise has happened. An indicator of attack (IoA) focuses on the attacker's behavior while an attack is underway, such as one process injecting code into another, regardless of which file is involved. NIST incident handling guidance also separates precursors, signs that an incident may happen soon, such as an advisory that a group is targeting your industry, from indicators, signs that one has occurred or is occurring.
Indicator of compromise on the CompTIA Security+ exam
IoCs are central to SY0-801 objective 2.5, which asks you to analyze indicators of malicious activity in a scenario, and they return in objective 4.7, where incident responders detect, confirm and scope an incident. Expect scenarios with log excerpts or lists of findings, such as an unsigned process in AppData, beaconing to a new domain, impossible travel or event ID 1102 showing the Security log was cleared, followed by a question about what they indicate together. Distractors include vulnerability (a weakness, not evidence of a breach), false positive and precursor. STIX and TAXII themselves belong to the threat intelligence material in objective 2.1.