Indicator of compromise (IoC)
IoC · IOC · indicators of compromise · IoA · indicator of attack · indicateur de compromission
A technical trace suggesting that a system has probably been compromised: a malicious IP address or domain, a file hash, a process name, a registry key.
In practice
IoCs are published by CERTs, vendors and sharing communities, then loaded into the SIEM, EDR or firewall for automatic detection. Their shelf life is short: an attacker can change address or tweak a tool in minutes. They are therefore complemented by behaviour-based detection (indicators of attack, or IoAs) and by searching past data: an indicator published today can reveal an intrusion several weeks old.
Fictional case: CERT-FR publishes the domains used in a campaign against local authorities. A town hall’s analyst searches six months of DNS logs for them and finds a computer that contacted one three weeks earlier. The investigation starts before the attacker makes their move.
