Indicator of compromise (IoC)

Typical IoC types are atomic or computed observables: file hashes (MD5, SHA-1, SHA-256, and fuzzy hashes such as ssdeep or TLSH that tolerate small changes), IP addresses, domain names and URLs, email sender addresses and subjects, file names and paths, registry keys, mutex names, named pipes, user-agent strings, TLS certificate or client fingerprints (JA3 and its successor JA4), and YARA rules describing byte patterns. RFC 9424 (IETF, 2023), "Indicators of Compromise (IoCs) and Their Role in Attack Defence", describes a lifecycle of discovery, assessment, sharing, deployment, detection, reaction and end of life, and stresses that IoCs remain valuable precisely because they are cheap to share and deploy at scale.

The limiting factor is fragility, captured by David Bianco's 2013 Pyramid of Pain. From bottom to top it ranks hash values (trivial for an attacker to change), IP addresses (easy), domain names (simple), network and host artefacts (annoying), tools (challenging) and TTPs (tough). A recompiled binary has a new hash; infrastructure rotates in hours. RFC 9424 frames this as a trade-off between precision and fragility: a SHA-256 match is nearly certain but easily evaded, while broader indicators last longer but produce more false positives. Indicators of attack (IoAs), a term popularised by endpoint security vendors, describe behaviours in progress rather than artefacts left behind and sit near the top of the pyramid, overlapping with ATT&CK-mapped detection rules.

Sharing relies on standard formats and handling rules. STIX 2.1 (OASIS, 2021) models indicators as patterns linked to malware, threat actors, campaigns and sightings, and TAXII 2.1 transports them over HTTPS; MISP is the widely used open-source sharing platform, and OpenIOC was Mandiant's earlier XML format. The Traffic Light Protocol, in FIRST's TLP 2.0 (2022), sets redistribution limits with the labels TLP:RED, TLP:AMBER, TLP:AMBER+STRICT, TLP:GREEN and TLP:CLEAR. In Denmark, CFCS (Center for Cybersikkerhed), since 2025 part of Styrelsen for Samfundssikkerhed, and sector CERTs such as SektorCERT distribute indicators to their constituencies.

Operational quality depends on assessment and ageing. Indicators need a source, a first-seen and last-seen date, confidence and context; without expiry, feeds accumulate stale entries that generate noise and consume SIEM resources. Shared infrastructure causes false positives: CDN and cloud IP addresses, parked or sinkholed domains, and hashes of legitimate dual-use tools. Matching should be done retroactively as well as in real time, because indicators often arrive days after the intrusion, which requires log retention long enough to search back. An IoC hit is evidence to triage, not proof of compromise, and the absence of hits proves little against an adversary that uses unique infrastructure per victim.