Observable evidence that a system has been breached—IPs, file hashes, domain names, patterns.
Indicators of Compromise (IOCs) are forensic artefacts indicating systems have been compromised—malicious IP addresses, file hashes, domain names, registry keys, or network patterns. During incidents, responders identify IOCs to scope compromise and detect affected systems. IOCs are shared with the security community to help others detect the same threats. IOC feeds enable automated detection in SIEM and security tools.
Why It Matters
The DSC Perspective:
IOCs help determine incident scope and detect compromise across your environment. Collect IOCs during investigations and use them to search for other affected systems. Share IOCs responsibly to help others.