Observable evidence that a system may have been breached—such as malicious IPs, file hashes, or domain names.
Indicators of Compromise (IOCs) are forensic artefacts indicating potential security breaches—malicious IP addresses, domain names, file hashes, unusual network patterns, or registry changes associated with known attacks. IOCs enable detection of threats by matching observed activity against known malicious indicators. Security tools (SIEM, EDR, firewalls) use IOC feeds to identify and block threats. IOCs have limited lifespan as attackers change infrastructure, so timely, relevant feeds are essential.
Why It Matters
The DSC Perspective:
IOCs enable automated threat detection. Integrating IOC feeds into your security tools helps identify known threats. However, IOCs alone aren't sufficient—behavioural detection catches threats that IOCs miss.