Indicator of compromise

Short description: Artifact observed on a network or in an operating system that indicates a computer intrusion

An indicator of compromise (IoC) in computer forensics is an artifact observed on a computer network or within an operating system that, with high confidence, indicates a computer intrusion.

Types of indicators

Common IoCs include virus signatures, suspicious IP addresses, MD5 hashes of malware files, and malicious URLs or domain names associated with botnet command and control servers. Once IoCs are identified through incident response or forensic analysis, they can be used for early detection of future attacks with intrusion detection systems and antivirus software.

Automation and sharing

Several standards and initiatives aim to automate IoC processing and sharing:

• The Incident Object Description Exchange Format (IODEF) standardizes how incident information is described and exchanged.
• Structured Threat Information Expression (STIX) is used to represent cyber threat information.

Known indicators are often exchanged within the cybersecurity industry, commonly using the Traffic Light Protocol (TLP) to indicate how information may be shared. Other frameworks and standards are also used to support secure information sharing.

See also

• AlienVault
• Mandiant
• Malware
• Malware Information Sharing Platform