Glossary

Indicator of compromise (IOC)

A piece of forensic evidence, such as a file hash or IP address, suggesting a system has been breached or contacted by an attacker.

Also called: IOC, indicators of compromise

An indicator of compromise (IOC) is a piece of forensic evidence, such as a malicious file hash, an IP address, a domain, or a registry key, that suggests a system has been breached or is communicating with an attacker's infrastructure. Analysts collect IOCs during investigations and feed them into detection tools so the same artifact triggers an alert if it appears elsewhere in the environment.

IOCs differ from behavioral detections in that they are static and specific: an IOC matches something already known to be malicious, while techniques cataloged in the MITRE ATT&CK framework or flagged by user and entity behavior analytics can catch novel attacks that reuse no known artifact. Shared IOCs are a core product of threat intelligence feeds and are typically loaded into a SIEM or endpoint detection and response tool for automated matching.

IOCs matter for fast containment once a threat is confirmed, but they age quickly: attackers rotate infrastructure and file hashes routinely, so an IOC-only detection strategy misses new campaigns. The common pitfall is treating a long IOC list as a substitute for behavioral and technique-based detection rather than a complement to it.

Last reviewed September 22, 2026

In the index now

Related terms

Threat intelligence Analyzed information about attacker groups, tools, and techniques used to anticipate and defend against threats, not just react to them. SIEM (security information and event management) A platform that centralizes and correlates log and event data across an IT environment to detect and investigate security threats. MITRE ATT&CK framework A public knowledge base of adversary tactics and techniques used as a shared vocabulary for describing attacker behavior. Endpoint detection and response (EDR) Software that continuously records endpoint activity, applies detection logic, and lets responders investigate and contain threats. Security operations center (SOC) The team responsible for continuously monitoring an organization's systems, triaging alerts, and coordinating incident response.

Related tools

LevelBlue Open Threat Exchange Free, community-contributed threat-intelligence platform of shared indicators of compromise, now operated by LevelBlue.

Related guides

Security analytics, explained How security teams turn logs and network noise into detected threats — SIEM, threat intelligence, and the metrics that measure a SOC's speed.