Dictionary · Defensive Security
Indicator of Compromise
IoC — Indicator of Compromise
Detection · Intermediate
An observable artifact that suggests a system may already be compromised, such as a malicious file hash, a domain, or an unusual scheduled task.
Indicators help you search. A match is a lead, because a hash or address can be reused, retired, or coincidental. Context decides whether it is your incident.
Example: A threat report publishes a file hash. The endpoint platform finds that hash on one laptop, which starts an investigation.
Common misconception
- An indicator match is not a full conclusion. It is a reason to investigate.