Indicators of Compromise (IOCs)

IOCs, or indicators of compromise, are pieces of digital evidence that suggest a network, system, or account may have been breached. They help security teams decide whether suspicious activity points to a genuine security incident and where to investigate next.

Key Takeaways

• IOCs give security teams concrete evidence they can search for across systems, networks, and accounts.
• IOC detection supports investigation by helping analysts distinguish suspicious events from confirmed compromise.
• Some indicators are easy for attackers to replace, while behavior-based patterns are harder to evade.
• Organizations get the most value from IOCs when they combine them with continuous monitoring and a defined response process.

How Indicators of Compromise Work

Indicators of compromise work by giving security teams specific, searchable artifacts they can match against network logs, endpoint telemetry, and email records to find evidence of malicious activity.

IOC Search Across Network and Host Artifacts

CISA guidance describes this as IOC search: collecting known-bad indicators from multiple sources, searching for them in network and host artifacts, and assessing the results to eliminate false positives.

When a threat intelligence feed publishes a set of IOCs tied to a known ransomware campaign, for example, a security operations center (SOC) can ingest those indicators into a security information and event management (SIEM) platform and scan historical and real-time data for matches. A match flags an event for investigation, since legitimate activity can sometimes produce the same artifact. The analyst's job is to assess context, eliminate false positives, and determine whether the match represents a genuine compromise.

Continuous Monitoring as an Ongoing Process

The NIST Cybersecurity Framework 2.0 maps IOC detection to its DETECT function, which calls for continuous monitoring across networks, hardware, software, personnel activity, and external service providers. In practice, IOC detection is an ongoing process: organizations collect known-bad indicators from multiple sources, search for them across host and network artifacts, and assess results to separate real threats from noise.

Common Types of Indicators of Compromise in Cybersecurity

Indicators of compromise fall into several categories depending on where the evidence appears, and each type gives security teams a different angle on a potential compromise.

Suspicious Network Traffic and DNS Anomalies

Unusual spikes in outbound traffic often signal that malware is exfiltrating data or communicating with a command-and-control (C2) server. Security teams look for connections to known malicious IP addresses, which government agencies regularly publish in advisories tied to active threat campaigns. DNS anomalies add another layer: unexpected resolution servers, queries to domains with high-entropy or randomized names, or DNS zone transfers that should not be occurring can all indicate that an attacker has established a foothold. Mismatched port-application traffic, where an application communicates over a port typically reserved for a different protocol, is another reliable network-based indicator. A web browser sending traffic over port 443 is expected, but a database process doing the same warrants investigation.

Unexpected Host and File Changes

Host-based IOCs appear on individual endpoints and servers. Unauthorized modifications to system files or configurations, unexpected processes consuming significant resources, and the creation of new user accounts without a corresponding IT ticket are all strong signals. File-based indicators overlap here: security teams track cryptographic hashes (MD5, SHA-1, or SHA-256) of known malicious executables and compare them against files discovered on endpoints. NIST SP 800-150 lists file hashes of malicious executables among its concrete IOC examples. Filename masquerading is a related tactic.

In the Interlock ransomware campaign, attackers named a keylogger output file to mimic a legitimate Windows process, blending malicious artifacts into the normal file system. Registry modifications on Windows systems, particularly changes to autostart keys that ensure malware runs after each reboot, are another common host-based indicator that defenders monitor closely.

Malicious Email Indicators

Email remains a primary attack vector, and the IOCs it generates are among the most actionable for early-stage detection. Phishing messages with malicious attachments or embedded URLs, spoofed sender addresses designed to impersonate trusted contacts, and authentication failures in SPF, DKIM, or DMARC records all qualify. Malicious URLs and the subject line text of malicious emails are also commonly shared between organizations as indicators.

Attachment hashes can be checked against threat intelligence feeds, and suspicious URLs can be detonated in sandboxed environments before a user ever clicks. One complication is that attackers increasingly send messages from compromised legitimate accounts rather than spoofed addresses, which means the sending infrastructure itself carries no malicious IOC. In those cases, the content and behavior of the email, such as an unusual wire transfer request from a known contact, become the primary indicators.

Behavioral and Login Anomalies

Behavioral IOCs focus on user and system activity instead of specific artifacts. Repeated failed login attempts may indicate credential stuffing or brute-force attacks. Logins from geographic locations that are unusual for a given user, especially when they occur in rapid succession from distant regions, suggest stolen credentials.

Anomalous account activity, such as a user suddenly accessing sensitive files they have never opened or sending mass emails to external contacts, can signal an account takeover. Swells in database read volume that do not correspond to normal business patterns are another behavioral indicator, often tied to data exfiltration. Because behavioral IOCs describe patterns rather than static artifacts, they tend to remain valid for longer periods than IP addresses or file hashes.

Metadata and Application-Layer Signals

File metadata, including author fields, creation timestamps, and version details, can reveal tampering or document provenance inconsistencies. A Word document claiming to originate from an internal department but carrying metadata from an unrelated user or tool is worth investigating. At the application layer, unusual HTML response sizes from a web server may indicate that an attacker has injected content or is extracting data through a web shell. Large numbers of requests for the same file, especially binaries or archives, can point to malware distribution from a compromised host.

In cloud and SaaS environments, traditional file-hash and IP-based IOCs are often unavailable; defenders look for irregular OAuth token usage, unexpected API call patterns, and unauthorized data exports as application-layer indicators. The FBI's Salesforce compromise advisory reflects this shift by focusing on platform compromise and data theft in a cloud environment.

The Pyramid of Pain and Indicators of Compromise

Indicators of compromise impose different costs on an attacker when defenders detect and block them.

The Six Levels of the Pyramid of Pain

David J. Bianco's Pyramid of Pain, published as an official SANS tool, ranks indicator types by how difficult they are for adversaries to change once defenders begin using them for detection. The model has six levels, from the base (trivially evaded) to the apex (extremely costly to evade):

Why Hash and IP Blocking Fall Short

The practical takeaway is that organizations focused exclusively on blocking hashes and IP addresses are operating at the base of the pyramid, where attackers can adapt within hours. An attacker who recompiles a binary produces an entirely new hash without altering the malware's functionality. The Akira ransomware family illustrates this directly: two published variants of the same Akira_v2 malware carry completely different SHA-256 hashes despite performing identical malicious operations.

Moving detection efforts toward the top of the pyramid forces attackers to fundamentally redesign their operations rather than simply rotating artifacts.

Indicators of Compromise vs. Indicators of Attack

IOCs and indicators of attack (IOAs) answer different questions at different points in the attack timeline.

IOCs as Retrospective Evidence

IOCs are retrospective. They represent evidence that a compromise has already occurred or is actively underway: a known-bad file hash found on an endpoint, a connection to a blocklisted IP address, or a malicious email attachment flagged by a threat intelligence feed. By the time an IOC is identified and shared, the artifact it describes may already have been rotated by the attacker.

IOAs as Real-Time Behavior Signals

IOAs, by contrast, focus on adversary behaviors in real time. An IOA-based approach monitors for patterns like unusual privilege escalation sequences, lateral movement between systems, or a legitimate tool being used in an unauthorized context. Because IOAs describe attacker behavior instead of tool-specific artifacts, they remain valid even after every artifact-level IOC has changed.

In practice, a strong detection program uses both: IOCs for automated matching against known threats at scale, and IOAs to cover gaps where attackers use novel tools or techniques that leave no traditional forensic artifact. The MITRE ATT&CK framework bridges the two by cataloging adversary techniques independently of specific malware or tools. It gives defenders a shared vocabulary for IOA-based detection.

How to Detect and Respond to Indicators of Compromise

Effective IOC detection requires a combination of automated tooling, current threat intelligence, and a defined response process.

The IOC Detection Pipeline

Here are a few steps organizations commonly take:

• Ingest Threat Intelligence Feeds: Subscribe to feeds from government sources like the Automated Indicator Sharing (AIS) program and sector-specific ISACs. These feeds use standardized formats like STIX and TAXII, which govern how indicators are structured and exchanged.
• Automate Matching and Triage: Feed IOCs into SIEM and endpoint detection platforms where they can be matched against incoming telemetry automatically. Manual comparison does not scale.
• Establish Response Procedures: A match requires validation. Define clear escalation paths so analysts can validate alerts, isolate affected systems if necessary, and begin remediation without delay.

Continuous Monitoring and Blast Radius Controls

• Monitor Continuously: Set up real-time monitoring of network traffic, system logs, and user behavior. IOC detection works best as an ongoing process supported by continuous monitoring.
• Limit Blast Radius and Train Staff: Segment networks, restrict user access to what each role requires, and run regular phishing awareness training so employees recognize suspicious messages before they interact with malicious content.

Limitations of Indicators of Compromise

IOC-based detection has structural weaknesses that no amount of feed tuning can fully resolve.

The Retrospective Nature of IOC Detection

The most fundamental limitation is timing: IOCs are inherently retrospective, describing artifacts associated with attacks that have already been observed. According to IBM's Cost of a Data Breach Report, the global mean time to identify and contain a breach reached 241 days in 2025, a record low that still represents nearly eight months of exposure. IOCs help shorten that window after the initial compromise.

Sophisticated attackers also rotate their infrastructure deliberately. Operational guidance from CISA acknowledges that many SOCs do not routinely use IOC feeds in operations because they are too voluminous and noisy and require significant resources to ingest, enrich, investigate, and respond.

Attack Types That Bypass IOCs

Certain attack types bypass the IOC model entirely. Living-off-the-land techniques abuse legitimate system tools that may produce few traditional malicious artifacts, and fileless attacks can leave little or no disk-based evidence to hash. Business email compromise (BEC) often involves no malware, no malicious attachments, and no suspicious URLs. The FBI IC3 reported $2.77 billion in BEC losses in 2024 alone, the highest-loss cybercrime category in its annual report, despite BEC producing few or no traditional IOCs.

Mature security programs pair IOC-based detection with behavioral analysis, anomaly detection, and TTP-focused hunting to cover those gaps.

Detection That Outlasts the Artifacts

IOCs remain a foundational layer of cybersecurity defense. They give teams concrete, searchable evidence to work with during and after an incident. Their value depends on how quickly they are shared, how accurately they are enriched with context, and how well they are integrated into automated detection workflows. The strongest security programs treat IOCs as one input among several, combining artifact matching with behavioral analysis that stays effective even when attackers change every hash, IP address, and domain they use. Prioritize detection strategies that move up the Pyramid of Pain, and the cost of attacking your organization goes up with them.

Frequently Asked Questions

What Is the Difference Between an IOC and a Threat Indicator?

The terms are often used interchangeably, but there is a subtle distinction. An IOC specifically refers to evidence that a compromise has occurred or is underway, such as a malicious file hash discovered on an endpoint. A threat indicator is a broader category that includes IOCs alongside other signals like vulnerability disclosures, threat actor profiles, and pre-attack reconnaissance activity. In practice, many threat intelligence platforms group both under the same feeds.

How Long Do IOCs Stay Useful?

It depends on the type. IP addresses and command-and-control domains can become stale quickly as attackers rotate infrastructure. File hashes lose value the moment malware is recompiled. Behavioral patterns tied to attacker tactics and techniques can remain useful much longer because they describe how an attacker operates instead of the specific tools they used. Security teams generally treat IOC feeds as perishable intelligence and prioritize automation to keep indicators current.

Can IOCs Detect Zero-Day Attacks?

Not reliably. Zero-day attacks exploit previously unknown vulnerabilities and typically use new tooling that has not yet been cataloged in any threat intelligence feed. Because IOC detection depends on matching known-bad artifacts, it is structurally blind to novel threats. Behavioral detection approaches that flag suspicious activity patterns, regardless of the specific tool or exploit used, are better suited for identifying zero-day activity.

How Are IOCs Shared Between Organizations?

Most formalized IOC sharing happens through machine-readable standards. Organizations exchange indicators in structured formats so systems can process them automatically, and many sectors also share relevant IOCs through coordinated information-sharing groups. In practice, automation makes it easier to distribute indicators quickly and keep them current.