What it means
An indicator of compromise, often shortened to IOC, is an observable used as a clue to malicious activity. Examples include a file hash, a domain, an address, or a recognizable pattern of behavior. Its value depends on context: an address may host many unrelated services, while a hash can identify an exact file but miss a slightly changed version. Indicators have a lifecycle, including assessment, deployment, review, and retirement. They help guide searches and defenses but do not replace investigation of how an attack works.
AN ILLUSTRATIVE SCENARIO
Checking a suspicious attachment across an organization
An analyst identifies a malicious attachment and searches for its hash across authorized endpoint records. Matching files identify devices that need further examination; a match does not by itself prove that a user executed the file. The team also checks related behavior and delivery records. Searching an associated hosting address produces legitimate connections too, so it is treated as a broader lead rather than an automatic reason to isolate every matching device.
Put it to work
- Record each indicator’s type, source, confidence, first-seen time, and relevant context. Keep the reason it is considered suspicious alongside the value.
- Choose the action deliberately: search, alert, or block. Test possible collateral impact before blocking shared infrastructure, and ensure someone owns exceptions and expiration.
- Review matches using surrounding evidence. Retire or update indicators when infrastructure changes or their usefulness declines, while retaining the history needed to explain past decisions.
How to check your work
Test a safe indicator against known records. Confirm that the matching logic uses the correct field and format, preserves context in alerts, and stops enforcing the indicator when its approved lifetime ends.
Connect the ideas
- Alert
A notification that a rule or model wants a human to look at one or more records.
- Evidence
A record you are willing to cite in a decision, with enough provenance to explain what it can prove.
- Hashing
A one-way fingerprint of data used to detect change or store verifiers, not a reversible way to hide records you must later read.
- False positive
An alert that did not represent the harmful event the detector was meant to catch.