Indicator of Compromise (IoC).

An Indicator of Compromise is a forensic artifact that defenders use to detect known malicious activity after or during an intrusion. Common IoCs include cryptographic hashes of malware, suspicious IP addresses, command-and-control domains, malicious URLs, mutex names, registry keys, and email indicators. IoCs are easy to share via STIX/TAXII and to operationalize in SIEMs, EDRs, firewalls, and DNS filters.

David Bianco's Pyramid of Pain (2013) explains why IoC type matters: hashes and IPs sit at the bottom — trivial for an attacker to change — while tools and TTPs at the top are far more costly to alter. Rotating a single dropper hash barely inconveniences a mature adversary, yet forcing them to rebuild their toolchain does. During the 2020 SolarWinds investigation, defenders published hashes and YARA rules for the SUNBURST backdoor, but reliable detection ultimately hinged on behavioral hunting because the atomic indicators were quickly burned and rotated.

Because attackers rotate atomic artifacts rapidly, most mature programs treat IoCs as one input among many alongside Indicators of Attack (IoAs) and TTPs. IoCs still deliver value for rapid, high-fidelity blocking and for retroactive threat hunting — sweeping historical logs to find where a newly disclosed indicator was already present.

flowchart TD
  A[Intrusion activity] --> B[Collect artifacts]
  B --> C[Hashes / IPs / domains]
  B --> D[Registry keys / mutexes]
  C --> E[Normalize to STIX]
  D --> E
  E --> F[Share via TAXII feed]
  F --> G[Enforce in SIEM / EDR / DNS]
  G --> H[Block and hunt historical logs]