What is an indicator of compromise (IOC)?
Short answer
An indicator of compromise is a piece of evidence that suggests a system was attacked, such as a malicious IP address, domain, file hash or unusual process. Defenders share IOCs so others can search their own logs and block known threats.
The details
IOCs are useful but short-lived, because attackers change infrastructure quickly. Behavior-based detections, often mapped to MITRE ATT&CK techniques, last longer than any single IOC.
Useful next reads and tools
- IOC Extractor & Defanger · tool
Terms explained
- Indicator of compromise
- An indicator of compromise (IOC) is observable evidence that a system may have been attacked, such as a malicious IP address, domain, URL or file hash.
- MITRE ATT&CK
- MITRE ATT&CK is a free knowledge base of real-world adversary tactics and techniques used to plan detections and structure investigations.
Sources
Related questions
Related Guides
GuideIncident Response
Triage and Containment of SSH Brute Force Attacks from Linux Logs
Practical techniques for parsing /var/log/auth.log, aggregating attacking subnets, and verifying whether key-only policies prevented breach.
Read more GuideIncident Response
The Binance Hack Timeline: How a 93-Cent Transaction Drained $6.3 Billion
A minute-by-minute account of the October 2026 Binance hack: the EIP-7702 sweep, the freeze race, the "one laptop" explanation, the North Korea attribution and where the money is now.
Read more GuideIncident Response
How to Backup Data on Windows 11: A Step-by-Step Guide
Learn how to backup data on Windows 11 using built-in tools, external drives, and isolation practices to defend against hardware failure and ransomware.
Read more GuideSmall Business Security
How to Write an Incident Response Plan Small Business Owners Use
Learn how to write an incident response plan small business teams can execute quickly. Protect operations, contain threats, and recover critical systems.
Read more