What is IOC?

IOCs are forensic breadcrumbs left by malicious activity. They are primarily reactive: extracted from a known-bad sample, a compromised host, or a post-incident investigation, then distributed so defenders can search for the same artifact across other systems before or after it causes damage elsewhere.

Indicators fall into several categories. Network IOCs include malicious IP addresses, C2 domain names, unusual DNS queries, and beaconing patterns with a regular time interval. File IOCs include cryptographic hashes (MD5, SHA-1, SHA-256) of malware samples, known malicious filenames, and suspicious file paths, often matched using YARA rules that describe byte patterns and strings rather than a single hash so minor variants of the same malware family still match. Host IOCs include registry keys used for persistence, scheduled tasks, unusual services, mutexes created by malware to prevent multiple infections, and process injection artifacts. Email IOCs include sender addresses, subject line patterns, attachment hashes, and embedded URLs.

IOCs are shared through threat intelligence platforms (MISP, OpenCTI), commercial feeds, government programs (CISA, ISACs), and vendor incident reports, frequently in the standardized STIX format transported over TAXII feeds so different tools can ingest the same indicator without manual reformatting. SIEM platforms ingest these feeds into lookup tables and automatically match them against incoming log data as it arrives, and XDR detection logic applies the same indicators across endpoint and cross-domain telemetry. Sigma rules serve a similar normalization purpose for log-based detection logic, letting a single rule be translated into the query syntax of different SIEM platforms.

The limitation is that IOCs are brittle by nature. Attackers recompile malware to change file hashes, use packers and polymorphism to defeat static hash matching, rotate IP addresses across bulletproof hosting providers, and register new domains daily through automated domain generation algorithms. An IOC feed also ages: an IP address flagged as malicious today may be reassigned to a legitimate cloud tenant next month, so a stale blocklist entry left in place too long generates its own false positives. IOC-based detection is fundamentally a cat-and-mouse game against infrastructure the attacker fully controls. This is why security teams increasingly complement IOC matching with behavioral detection using TTPs, which describe what an attacker must do to succeed and are far more durable than any single artifact.