What are Indicators of Compromise (IoCs)?

Indicators of Compromise (IoCs) are digital footprints of an adversary or a cyber threat, such as data found in system files or log entries, that can uniquely distinguish any malicious activity on a system or a network. Examples of an IoC includes various hashes of malware files (MD5, SHA1, SHA256, etc.), URLs or domain names of botnet command and control servers, virus signatures and IP addresses, use of specific registry entries, and others.

Any incident of a cyber attack, or even an attempt of a cyber attack, leaves behind some digital footprints (IOCs) of the malicious activity. In case of a breach, organizations or security experts can trace these footprints to analyze the overall impact and the depth of the breach. For instance, any failed attempt to access a database by an unknown user (as identified in log entries) indicates a possible attempt of a breach. Real-time tracking and proactive monitoring of these digital footprints (or IoCs) can help security experts and organizations to prevent any possible cyber attacks. Thus, using IoC’s, the security experts can analyze the cyber attack and also take preventive steps to protect the system or network from similar attacks in the future.

Anti-malware systems and threat intelligence platforms are also known to proactively use IoCs to detect and prevent malware infections, security breach, or any other security threat activities at an initial level.

Monitoring the Indicators of Compromise provides critical threat intelligence to an organization, which can help better understand any attempt of a cyber attack. Without IoC, the security firm and experts can not properly assess, link or analyze the cyber attack, as it provides the essential resources to perform complete forensic analysis. Collecting and linking IoCs in real time means that security experts can identify security incidents that may have been overlooked by other tools. If security teams discover patterns or recurrence of particular IoCs, they can update their security policies and tools to protect against future attacks as well. Several frameworks like STIX, TAXII, OpenIOC, etc. are in development and use, which can help standardize the reporting and documentation of IoCs. Any threat intel platform with support for conversion of multiple IoC formats (STIX 2.0, MISP, XML, CSV, JSON, YARA, OpenIOC, ATT&CK, MAEC, IODEF, etc.) can take the cyber threat intelligence efforts of an organization to the next level.