What is IOC (Indicator of Compromise)?

Indicators come in four broad families. Network IOCs are C2 IP addresses and domains, odd DNS queries, and beacons that call out on a fixed interval. File IOCs are MD5, SHA-1, and SHA-256 hashes of malware samples, known malicious filenames and paths, and YARA rules that match byte patterns and strings so small variants of one malware family still hit. Host IOCs are the registry run keys and scheduled tasks used for persistence, rogue services, and the mutexes malware creates so it doesn't infect the same machine twice. Email IOCs cover sender addresses, subject patterns, attachment hashes, and embedded URLs.

Indicators travel through threat intelligence platforms such as MISP and OpenCTI, commercial feeds, government programs (CISA, the sector ISACs), and vendor incident reports, usually as STIX objects carried over TAXII so a SIEM and an EDR can ingest the same indicator without anyone reformatting it. Two fields of a STIX 2.1 Indicator matter more to an analyst than the value itself. The confidence field is an integer from 0 to 100 stating how sure the producer is. The valid_until field is the time after which the producer says the indicator should stop counting; when it is missing, the spec puts no end date on it, so your blocklist keeps it forever unless you expire it yourself. The SIEM loads these feeds into lookup tables and matches them against logs as they arrive, and XDR applies the same lists to endpoint and identity telemetry.

How long an IOC stays useful depends on what it costs the attacker to replace it. David Bianco's Pyramid of Pain ranks indicators by exactly that. Hashes sit at the bottom, because changing a single bit of a file produces an unrelated hash. IP addresses are one step up, and an attacker who loses one can usually recover "without even breaking stride", in Bianco's words. Domains are slightly harder, because they have to be registered, paid for, and hosted, and a new one can take up to a day or two to become visible across the internet. The two cheap types fail differently, though. A SHA-256 hash never turns wrong: the file it names stays malicious, and the hash goes quiet once the attacker rebuilds. An IP address can turn wrong. Weeks after a takedown the same address may belong to a legitimate cloud tenant, and the old blocklist entry starts firing on clean traffic. Feeds that take this seriously age indicators out. MISP's decaying model gives each indicator a base score derived from things like source reliability, lowers it over a configured lifetime, and resets it to the base score every time someone records a new sighting. A workable policy is short lifetimes for IPs, longer ones for domains, and hashes kept indefinitely, with any network indicator past its lifetime treated as a lead to re-verify rather than a verdict.

IOC vs IOA: an indicator of attack (IOA) describes behavior while it happens instead of an artifact left behind. CrowdStrike describes IOAs as detecting what the attacker is trying to accomplish regardless of the malware or exploit used. The SHA-256 of one Mimikatz build is an IOC, and it misses the next recompile. "A process that is not a known security tool opened a handle to LSASS memory" is an IOA, and it fires whether the tool is Mimikatz, a custom dumper, or a built-in Windows DLL called through rundll32. An IOC asks whether you have seen this exact thing before; an IOA asks whether something is behaving the way attackers behave. You want both. IOCs are cheap to run and precise, which makes them the right tool for scoping once you know what to look for, and IOAs catch malware-free intrusions and tooling nobody has published yet.

In a business context, check who is asking: outside security the acronym has unrelated meanings. Inside a company's security program it means the same thing as here, and it is usually how a breach turns into a concrete question. A vendor advisory or an incident response firm hands over a list of hashes, domains, and IPs, and the business has to find out whether any of its machines ran those files or talked to those addresses, and when. How fast that gets answered depends on how much log history the company kept, a retention decision made long before the incident.

The ceiling on IOC-based detection is that the attacker controls every value. Malware gets repacked to change its hash, infrastructure moves across bulletproof hosting, and domain generation algorithms produce fresh candidate domains on a schedule. Matching IOCs is still worth doing, since it is the fastest way to catch reused infrastructure and to scope an incident, but it belongs alongside behavioral detection built on TTPs, which describe what an attacker must do and are far harder to change.