Indicators of Compromise and Their Types
Learn what an IoC is, how common IoC types differ, and why context determines whether an indicator is useful.
In this lesson, you will learn to:
- Define an Indicator of Compromise and distinguish it from a vulnerability, behavior, alert, and confirmed incident.
- Classify domain, IP, URL, hash, email, host, identity, network, and behavioral indicators and explain their defensive uses.
Indicators of Compromise and Their Types
This lesson introduces Indicators of Compromise as observable clues associated with suspicious or malicious activity. You will classify common IoC types, understand their strengths and limits, and prepare an IoC record that another defender can investigate safely.
What an IoC Is and Is Not
An Indicator of Compromise (IoC) is an observable artifact or pattern that may indicate malicious activity, unauthorized access, or a related security event. Examples include a file hash found in a suspicious attachment, a domain used in a phishing message, an unusual mailbox rule, or a sequence of authentication events that deserves investigation.
An IoC is a clue, not a verdict. A domain in a threat report does not prove that every request to the domain is malicious. An IP address can be shared, reassigned, or part of a legitimate cloud service. A hash can identify one exact file while missing a repacked variant. A behavioral indicator may be more durable than a single value, but it can also be harder to detect accurately.
Keep four concepts separate. A vulnerability is a weakness that may be exploitable. An alert is a detection signal produced by a tool or analyst. An IoC is evidence that may support investigation or detection. A confirmed incident is an organizational determination made through an authorized response process. Confusing these labels leads to premature conclusions and poorly matched actions.
Common IoC Types and Their Limits
Network and infrastructure IoCs include IP addresses, domains, URLs, DNS records, certificates, autonomous system numbers, and hosting relationships. They can support DNS, proxy, firewall, and certificate hunts, but shared infrastructure and changing ownership can create false positives.
File IoCs include cryptographic hashes, filenames, paths, mutexes, and signer information. Hashes are precise for an exact object but often brittle when files change.
Host and process IoCs include process names, command-line fragments, persistence locations, scheduled tasks, registry paths, and service names. They can be powerful when combined with parent process, user, time, and endpoint context.
Email IoCs include sender infrastructure, message identifiers, attachment hashes, URLs, display-name patterns, and authentication results.
Identity IoCs include impossible travel, unfamiliar consent grants, suspicious MFA changes, token use, and unusual privilege activity.
Behavioral IoCs describe sequences or conditions rather than one value, such as a new inbox rule followed by an unusual sign-in and cloud download. They are often more resilient than a single domain or hash, but require better telemetry and careful testing. Classify the IoC, record its source and dates, state the related behavior, and identify whether it is for investigation, detection, blocking, or sharing.