An indicator of compromise (IOC) is a piece of forensic evidence that a security incident has occurred or is occurring. It is the digital fingerprint an attacker leaves behind: a malicious IP address, a file hash, or an unexpected change to system files that tells a security team something is wrong.
IOCs answer a blunt question: has this environment been touched by an attacker? Unlike a vulnerability, which is a weakness that could be exploited, an IOC is a sign that exploitation has likely already occurred. That distinction shapes how security teams respond, since an IOC usually means the clock is already running.
What an Indicator of Compromise Is
At its core, an IOC is a fact. A specific, observable artifact tied to malicious activity. It might be the address of a server an attacker used for command and control, the hash of a malware sample, or a domain name registered the day before a phishing campaign began.
What makes IOCs useful is that they are concrete and shareable. When one organization investigates a breach and publishes the IOCs it found, every other security team can search their own logs for the same artifacts. A match means the same cyber threat may have reached them too.
IOCs are inherently backward-looking. They describe evidence of compromise that already exists, which is why they sit at the center of detection and forensic analysis rather than prevention. Finding an IOC in your environment begins a cybersecurity investigation — it does not conclude one.
Common Types of Indicators of Compromise
IOCs come in several forms, grouped by where the evidence shows up. Most types of IOCs fall into four broad categories:
- Network indicators, including malicious IP addresses, suspicious domain names and URLs, and unusual network traffic such as repeated callbacks to a command-and-control server.
- Host-based indicators, including changes to system files, new registry keys, an unfamiliar user account, or a rogue process running on an endpoint.
- File-based indicators, including the hash of a known malware sample, an unexpected executable, or a file with a mismatched extension.
- Behavioral indicators, including an anomaly in login timing, privilege escalation, or a spike in outbound data that points to exfiltration.
No single category tells the whole story. A mature program correlates indicators across all four, since a malicious IP address paired with an anomaly in a user account is far stronger evidence than either signal alone.
Common Examples of Indicators of Compromise
Categories describe where to look. Specific examples describe what to look for. These are the most common indicators security teams watch for day to day:
- A suspicious IP address or unfamiliar domain appearing in outbound network traffic is often a sign of command and control.
- Unusual login attempts, such as a single user account signing in from two countries minutes apart, or a burst of failures followed by one success.
- A sudden spike in database read volume, which can mean an attacker is trying to steal data in bulk.
- Unexpected configuration changes to system files, registry keys, or firewall rules that no one on the team made.
- Anomalous traffic patterns, like data leaving the network on an odd port or at an odd hour.
These common IOCs are known indicators that security professionals can match against a feed in seconds. The harder cases hide in the gaps between them, which is why treating indicators of compromise as a set of correlated signals matters more than tracking individual indicator types in isolation.
Indicators of Compromise vs. Indicators of Attack
IOCs are often confused with indicators of attack (IOAs), and the difference matters. An IOC is evidence that a breach has already happened. An indicator of attack is a sign that an attack is underway.
Think of it this way: an IOC is the broken window you find the morning after. An IOA is the sound of glass breaking as it happens. IOCs are reactive and artifact-based — a specific hash or address you can look up. IOAs are behavioral and intent-based: sequences of actions that resemble an attacker working toward a goal, regardless of which tools they use.
Both have a place. IOCs enable fast, shareable detection once a threat is known. IOAs help catch novel attacks that have no published IOC yet. The strongest security teams use them together.
How Security Teams Use Indicators of Compromise
Once an IOC is known, the work is matching it against reality. Security teams feed IOCs into the tools that monitor their environment, allowing those tools to raise an alert on any match.
- Detection. IOCs power signature-based detection in firewalls, endpoint agents, and an intrusion detection system that flags traffic matching a known-bad address or hash.
- Security information and event management. A SIEM platform correlates IOCs with collected logs and security events, turning scattered signals into a single alert.
- Incident response. When a match is found, responders use the IOC to scope the security incident, identify all affected servers and endpoints, and contain the threat.
- Threat hunting. Analysts proactively search for IOCs associated with active campaigns before any alert fires, often drawing on threat intelligence feeds and open-source intelligence.
IOCs have a short shelf life. Attackers rotate IP addresses, swap domain names, and recompile malware to change its hash, so an IOC that was good yesterday can be useless tomorrow. Teams treat IOC feeds as constantly refreshed inputs, not static lists, and pair them with broader security monitoring to catch threats the feeds miss.
IOC Monitoring and Management in Practice
Knowing what an IOC is matters little without a process to act on it. Strong IOC management comes from operations, not definitions. Information security professionals treat it as an ongoing cycle: collecting indicators from trusted feeds, validating them, pushing them into security tools, and retiring them once they go stale.
Most of this runs through automation. Modern security solutions ingest IOC feeds and apply them across the security infrastructure, from firewalls to endpoint software and intrusion detection systems, without manual effort. AI and machine learning increasingly handle the correlation, spotting when a low-confidence IOC lines up with other security data to sharpen threat detection. This continuous, automated approach is the heart of effective indicator management, turning raw artifacts into defense.
Continuous IOC monitoring keeps the program honest. Monitoring against live threat detection feeds enables a security team to raise high-fidelity alerts rather than drowning in noise. Layered into advanced security systems, automated IOC detection serves as an early warning of advanced threats rather than a record of a breach after the fact.
The Limits of Indicators of Compromise
IOCs are powerful, but they carry a built-in constraint. By definition, an IOC exists only after someone has been compromised and the evidence has been documented. The first victim of a new campaign has no IOC to match against, which is why IOCs alone cannot stop a future attack.
This reactive nature is why IOCs work best as a single layer within a broader cybersecurity defense. Pairing them with behavioral detection, intelligence on each active cyber threat, and continuous monitoring of your own attack surface reduces the risk that a quiet intrusion will become a full data breach.
How SecurityScorecard Puts Indicators of Compromise to Work
The value of an IOC depends on how fast and how accurately it is produced. SecurityScorecard’s STRIKE threat intelligence team generates and enriches indicators of compromise at scale from a global threat vantage point. STRIKE pairs 27 billion data points collected every week with over 2 billion daily malware sinkhole requests and our DriftNet internet-scanning engine, which surfaces attacker infrastructure across the wider internet. STRIKE attributes the resulting IOCs to specific threat actors at 99.9% accuracy and feeds them into our TITAN AI platform.
That work shows up in real investigations. When STRIKE tracked the LapDogs campaign, a single self-signed Transport Layer Security (TLS) certificate and a matching network fingerprint became the IOCs that let us trace more than 1,000 infected hosts worldwide. In the MOVEit breach, a file hash and a webshell artifact were the indicators that exposed which servers attackers had reached.
TITAN AI folds these indicators directly into third-party risk, so a malicious signal linked to a known threat actor on a vendor’s network surfaces as a prioritized alert rather than a buried log line. For teams that want hunting and response handled on their behalf, our TITAN MAX managed services extend your security team end-to-end. Request a demo to see how TITAN AI turns raw indicators into action.
