Indicator of compromise (IoC)
In detection and threat intelligence, an indicator of compromise is an observable artefact, such as a file hash, an address, a domain or a registry key, that is associated with malicious activity. Indicators are the cheapest form of intelligence to consume and the easiest for an adversary to change, which is exactly the trade-off.
How it works
An indicator is produced when someone analyses an intrusion and extracts artefacts from it. Those artefacts are published, distributed through feeds and sharing communities in structured formats, and loaded into detection tooling, which matches them against telemetry: hashes against files executed, domains against resolutions, addresses against connections.
The value is speed. Matching a known artefact is computationally trivial, needs no behavioural model and produces a high-confidence alert with an obvious next step. For commodity threats reusing infrastructure, indicator matching does real work.
What goes wrong
Indicators are the most fragile layer of intelligence, and their fragility is graded. A file hash changes if one byte changes, which costs an attacker a rebuild. A domain or address changes when the operator rotates infrastructure, which costs an afternoon. What is genuinely expensive to change is the way an adversary behaves: the sequence of techniques, the tooling patterns, the choices that make an operation work. Those are the tactics, techniques and procedures, and they are the level that MITRE ATT&CK exists to describe.
A detection programme built on indicator feeds alone therefore has a structural ceiling: it detects what somebody else has already been hit by, with infrastructure the adversary has not yet rotated. It does not detect a targeted operator at all, because a targeted operator’s infrastructure has never appeared in anyone’s feed. The other cost is volume. An unfiltered feed loaded straight into a SIEM generates alerts on stale entries, on shared hosting and on legitimate services, and the resulting noise is what causes an analyst to close the one that mattered.
Where this shows up in an audit
In a red team exercise we generate indicators deliberately and record them, so the client can check afterwards whether their tooling would have matched any of them, and at what point. The usual answer is that the infrastructure we built for the engagement was in no feed and matched nothing, which is the finding: it makes the case for behavioural detection in a way no vendor briefing can. On the intelligence side, credentials and session tokens appearing in criminal marketplaces are indicators of a compromise that already happened, which is what how we watch for your data and credentials outside your perimeter is built to find.