What is IOC?

IOCs are forensic breadcrumbs left by malicious activity. They are primarily reactive: extracted from a known-bad sample or post-incident investigation, then used to search for the same artifact across other systems. Common IOC types include cryptographic file hashes (MD5, SHA-256) of malware, IP addresses of C2 servers, domain names used for phishing or C2, mutexes created by malware, and specific registry keys used for persistence.

IOCs are shared through threat intelligence platforms (MISP, OpenCTI), commercial feeds, and government programs (US-CERT, ISACs). SIEM platforms ingest IOC feeds and automatically match them against incoming log data.

The limitation: IOCs are brittle. Attackers recompile malware to change hashes, rotate IP addresses, and register new domains daily. IOC-based detection is a cat-and-mouse game. This is why security teams increasingly complement IOC matching with behavioral detection using TTPs, which attackers cannot trivially change.