{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/indicator-of-compromise","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/indicator-of-compromise/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/indicator-of-compromise/"},"term":{"en":"Indicator of compromise (IoC)","da":"Kompromitteringsindikator (IoC)"},"aka":{"en":["IoC","IOC"],"da":["IoC","IOC"]},"domain":["security"],"cluster":"security-operations","layer":"data","status":"current","era":2011,"summary":{"en":"A trace left behind by an attack, such as a known bad web address or file, that shows a system has probably been broken into.","da":"Et spor efter et angreb, fx en kendt ondsindet webadresse eller fil, der viser, at et system sandsynligvis er kompromitteret."},"body":{"formal":{"en":"A piece of evidence found on a system or network - an IP address, a domain name, a file's hash value, an odd account - that is known to be linked to a past attack and so suggests a break-in has happened.","da":"Et stykke bevis fundet på et system eller i et netværk - en IP-adresse, et domænenavn, en fils hashværdi, en mærkelig konto - som man ved hænger sammen med et tidligere angreb, og som derfor tyder på, at der har været indbrud."},"plain":{"en":"Like the footprints and a known burglar's tools found in a garden; they do not stop the break-in, but they tell you who has been there.","da":"Som fodspor og en kendt indbrudstyvs værktøj fundet i haven; de stopper ikke indbruddet, men de fortæller, hvem der har været der."},"inPractice":{"en":"A CFCS warning lists the IP addresses and file hashes a ransomware group uses; a shipping company's SOC searches three months of logs and finds one laptop that contacted one of the addresses.","da":"En advarsel fra CFCS nævner de IP-adresser og filhashes, en ransomware-gruppe bruger; et rederis SOC gennemsøger tre måneders logs og finder én bærbar, der har kontaktet en af adresserne."},"whyItMatters":{"en":"Shared traces let one victim's bad experience warn everyone else quickly, but attackers change them easily, so they catch yesterday's attacks better than tomorrow's.","da":"Delte spor gør det muligt for ét offers dårlige erfaring hurtigt at advare alle andre, men angribere skifter dem let, så de fanger gårsdagens angreb bedre end morgendagens."}},"deepDive":{"en":"Typical IoC types are atomic or computed observables: file hashes (MD5, SHA-1, SHA-256, and fuzzy hashes such as ssdeep or TLSH that tolerate small changes), IP addresses, domain names and URLs, email sender addresses and subjects, file names and paths, registry keys, mutex names, named pipes, user-agent strings, TLS certificate or client fingerprints (JA3 and its successor JA4), and YARA rules describing byte patterns. RFC 9424 (IETF, 2023), \"Indicators of Compromise (IoCs) and Their Role in Attack Defence\", describes a lifecycle of discovery, assessment, sharing, deployment, detection, reaction and end of life, and stresses that IoCs remain valuable precisely because they are cheap to share and deploy at scale.\n\nThe limiting factor is fragility, captured by David Bianco's 2013 Pyramid of Pain. From bottom to top it ranks hash values (trivial for an attacker to change), IP addresses (easy), domain names (simple), network and host artefacts (annoying), tools (challenging) and TTPs (tough). A recompiled binary has a new hash; infrastructure rotates in hours. RFC 9424 frames this as a trade-off between precision and fragility: a SHA-256 match is nearly certain but easily evaded, while broader indicators last longer but produce more false positives. Indicators of attack (IoAs), a term popularised by endpoint security vendors, describe behaviours in progress rather than artefacts left behind and sit near the top of the pyramid, overlapping with ATT&CK-mapped detection rules.\n\nSharing relies on standard formats and handling rules. STIX 2.1 (OASIS, 2021) models indicators as patterns linked to malware, threat actors, campaigns and sightings, and TAXII 2.1 transports them over HTTPS; MISP is the widely used open-source sharing platform, and OpenIOC was Mandiant's earlier XML format. The Traffic Light Protocol, in FIRST's TLP 2.0 (2022), sets redistribution limits with the labels TLP:RED, TLP:AMBER, TLP:AMBER+STRICT, TLP:GREEN and TLP:CLEAR. In Denmark, CFCS (Center for Cybersikkerhed), since 2025 part of Styrelsen for Samfundssikkerhed, and sector CERTs such as SektorCERT distribute indicators to their constituencies.\n\nOperational quality depends on assessment and ageing. Indicators need a source, a first-seen and last-seen date, confidence and context; without expiry, feeds accumulate stale entries that generate noise and consume SIEM resources. Shared infrastructure causes false positives: CDN and cloud IP addresses, parked or sinkholed domains, and hashes of legitimate dual-use tools. Matching should be done retroactively as well as in real time, because indicators often arrive days after the intrusion, which requires log retention long enough to search back. An IoC hit is evidence to triage, not proof of compromise, and the absence of hits proves little against an adversary that uses unique infrastructure per victim.","da":"Typiske IoC-typer er atomare eller beregnede observationer: filhashes (MD5, SHA-1, SHA-256 og fuzzy hashes som ssdeep eller TLSH, der tåler små ændringer), IP-adresser, domænenavne og URL'er, afsenderadresser og emnelinjer i e-mails, filnavne og stier, registreringsnøgler, mutex-navne, named pipes, user agent-strenge, TLS-certifikater eller klientfingeraftryk (JA3 og efterfølgeren JA4) samt YARA-regler, der beskriver bytemønstre. RFC 9424 (IETF, 2023), \"Indicators of Compromise (IoCs) and Their Role in Attack Defence\", beskriver en livscyklus med opdagelse, vurdering, deling, udrulning, detektion, reaktion og udfasning og understreger, at IoC'er netop er værdifulde, fordi de er billige at dele og udrulle i stor skala.\n\nDen begrænsende faktor er skrøbelighed, som David Biancos Pyramid of Pain fra 2013 indfanger. Nedefra og op rangerer den hashværdier (trivielle for en angriber at ændre), IP-adresser (lette), domænenavne (enkle), netværks- og værtsartefakter (irriterende), værktøjer (udfordrende) og TTP'er (svære). En genkompileret binærfil får en ny hash; infrastruktur udskiftes på få timer. RFC 9424 beskriver det som en afvejning mellem præcision og skrøbelighed: et SHA-256-match er næsten sikkert, men let at omgå, mens bredere indikatorer holder længere, men giver flere falske positiver. Indicators of attack (IoA'er), et begreb gjort populært af leverandører af endpoint-sikkerhed, beskriver igangværende adfærd frem for efterladte artefakter og ligger nær toppen af pyramiden, hvor de overlapper med detektionsregler kortlagt til ATT&CK.\n\nDeling bygger på standardformater og regler for håndtering. STIX 2.1 (OASIS, 2021) modellerer indikatorer som mønstre, der er knyttet til malware, trusselsaktører, kampagner og observationer, og TAXII 2.1 transporterer dem over HTTPS; MISP er den udbredte open source-platform til deling, og OpenIOC var Mandiants tidligere XML-format. Traffic Light Protocol, i FIRST's TLP 2.0 (2022), fastsætter grænser for videredeling med mærkerne TLP:RED, TLP:AMBER, TLP:AMBER+STRICT, TLP:GREEN og TLP:CLEAR. I Danmark distribuerer CFCS (Center for Cybersikkerhed), der siden 2025 er en del af Styrelsen for Samfundssikkerhed, og sektor-CERT'er som SektorCERT indikatorer til deres målgrupper.\n\nDen operationelle kvalitet afhænger af vurdering og aldring. Indikatorer skal have en kilde, en dato for første og seneste observation, en konfidens og kontekst; uden udløb ophober feeds forældede poster, der giver støj og bruger SIEM-ressourcer. Delt infrastruktur giver falske positiver: IP-adresser hos CDN'er og cloududbydere, parkerede eller sinkholede domæner og hashes af legitime værktøjer med dobbelt anvendelse. Matchning bør ske bagudrettet såvel som i realtid, fordi indikatorer ofte ankommer dage efter indbruddet, og det kræver en logopbevaring, der er lang nok til at søge tilbage. Et IoC-hit er et spor, der skal triageres, ikke et bevis på kompromittering, og fravær af hits beviser ikke meget over for en modstander, der bruger unik infrastruktur for hvert offer."},"edges":[{"type":"requires","to":"security/security-incident","confidence":"high","strength":"normal"},{"type":"part-of","to":"security/threat-intelligence","confidence":"high","strength":"normal"},{"type":"contrasts-with","to":"security/mitre-attack","why":{"en":"A trace is a single thing an attacker left behind and can easily change; MITRE ATT&CK describes how attackers behave, which is much harder for them to change.","da":"Et spor er en enkelt ting, en angriber har efterladt og let kan skifte; MITRE ATT&CK beskriver, hvordan angribere opfører sig, hvilket er meget sværere for dem at ændre."},"confidence":"high","strength":"normal"},{"type":"used-with","to":"security/siem","why":{"en":"Lists of traces are loaded into the SIEM so that every new log entry is checked against them.","da":"Lister over spor lægges ind i SIEM'en, så hver ny logpost holdes op mod dem."},"confidence":"high","strength":"primary"}],"depth":2,"sources":[{"title":"NIST SP 800-150 - Guide to Cyber Threat Information Sharing","url":"https://doi.org/10.6028/NIST.SP.800-150","tier":"standard","publisher":"NIST"},{"title":"Cyber Security Fast Track - SIEM module","tier":"course-material"},{"title":"RFC 9424 - Indicators of Compromise (IoCs) and Their Role in Attack Defence","url":"https://www.rfc-editor.org/rfc/rfc9424","tier":"standard","publisher":"IETF"}],"draft":true}