Indicator Of Compromise (IoC).

What is an indicator of compromise?

NIST SP 800-61r3 defines indicators of compromise as technical artifacts or observables that suggest that an attack is imminent or is currently underway, or that a compromise may have already occurred. They are clues. A single clue does not prove a breach, but it tells a team where to look.

What counts as an indicator?

Typical examples, given here as general illustrations, include:

• File hashes, which are fingerprints of known malicious files.
• IP addresses and domain names linked to an attack.
• Email details, such as sender addresses or subject lines used in a campaign.
• Traces left on a device, such as file names or registry changes.
• Unusual behavior, such as a login from an unexpected place.

How are they used?

Security tools can compare traffic and files with lists of known indicators and raise an alert on a match. Analysts can also search their logs for indicators to see whether a known threat has already reached them. When one team finds indicators during an investigation, it can share them so that others can check for the same traces.

Why does it matter?

Indicators give defenders something concrete to check. Because they are specific, they are easy to share and to act on, even for a small team. They can help answer an urgent question: has this known attack already touched us? They also support the early stages of an investigation, by pointing to the devices, accounts or addresses that need a closer look.

What are the limits?

Indicators can go out of date. Attackers can change addresses and rebuild files, so a list that worked before may catch little later. A match can also mislead, for example if an address once used by an attacker is later used by an innocent site. Indicators also say what was seen, not why. To be useful they often need context, such as who is behind the activity, how reliable the source is and what the attacker may do next. It helps to use them as one input among several and to retire old ones on a schedule.

How should a team handle a match?

A match is a reason to look closer, not a verdict. A team can check what else happened on the same device or account, decide how serious it is, and follow its incident response plan if the signs hold up. Recording where each indicator came from and when it was seen makes later review easier.

Is an indicator of compromise the same as threat intelligence?

No. Indicators are raw pieces of evidence. Threat intelligence is the wider work of collecting and explaining information about threats, and indicators are one input to it.

Is an indicator of compromise the same as a vulnerability?

No. A vulnerability is a weakness that could be used. An indicator is evidence that something harmful may be happening or has happened.

Brandefense Cyber Threat Intelligence adds context to what it finds outside your network.

Indicators can be shared in a consistent format with STIX and TAXII.