Indicator of compromise (IoC) vs MITRE ATT&CK

Why they differ

A trace is a single thing an attacker left behind and can easily change; MITRE ATT&CK describes how attackers behave, which is much harder for them to change.

Indicator of compromise (IoC)

Detection & response

A trace left behind by an attack, such as a known bad web address or file, that shows a system has probably been broken into.

Formal

A piece of evidence found on a system or network - an IP address, a domain name, a file's hash value, an odd account - that is known to be linked to a past attack and so suggests a break-in has happened.

In plain English

Like the footprints and a known burglar's tools found in a garden; they do not stop the break-in, but they tell you who has been there.

In practice

A CFCS warning lists the IP addresses and file hashes a ransomware group uses; a shipping company's SOC searches three months of logs and finds one laptop that contacted one of the addresses.

Why it matters

Shared traces let one victim's bad experience warn everyone else quickly, but attackers change them easily, so they catch yesterday's attacks better than tomorrow's.

MITRE ATT&CK

Detection & response

A free, public catalogue of the goals and methods real attackers use, giving defenders a shared language for how attacks unfold.

Formal

A knowledge base kept by the not-for-profit MITRE, built from observed attacks, that sorts attacker behaviour into tactics (the goal, such as lateral movement) and techniques (how the goal is reached), each with a number, examples and advice on detection.

In plain English

Like a handbook of every trick known to pickpockets, sorted by stage - picking a victim, distracting them, taking the wallet, getting away - so guards know what to watch for at each step.

In practice

A region's SOC maps its detection rules onto the ATT&CK matrix and sees it has no rule at all for attackers stealing browser cookies, so that becomes the next rule it writes.

Why it matters

Attackers can swap addresses and files in minutes, but their methods change slowly; watching for methods gives longer-lasting defence and a common way to report it.

Shared connections

Detection rule Threat hunting Threat intelligence