IoC (Indicator of Compromise)
Definition
Observable artefact linked to malicious activity. File hashes (MD5, SHA-256, ImpHash, ssdeep, TLSH), IPs, domains, URLs, registry keys, mutex names, named pipes, scheduled task names, service names. Shared between organisations using STIX (data model) over TAXII (transport).
Related terms
- Entropy (Shannon)
- Per-byte information density of a file or section. Plain code sits around 5.5; packed or encrypted sections exceed 7.0. A PE with...
- ImpHash
- Mandiant's hash of the ordered list of imported functions in a PE file's import table. Survives recompilation that does not change imports;...
- ISAC (Information Sharing and Analysis Center)
- A sector-specific membership organisation that collects, analyses, and redistributes threat intelligence among its members under confidentiality agreements. Examples include FS-ISAC (financial services),...
- PE (Portable Executable) Header
- The Windows executable file format. Starts with an MZ DOS stub, points to a PE signature, then a COFF file header, an...
- STIX (Structured Threat Information eXpression)
- An OASIS open standard that defines a JSON-based language for describing cyber threat intelligence. STIX 2.1 defines objects for indicators, threat actors,...
- TAXII (Trusted Automated eXchange of Indicator Information)
- An OASIS open standard that defines an HTTPS-based protocol for transporting STIX content between organisations. A TAXII server exposes collections; clients poll...
- Threat Intelligence
- Processed, analysed information about adversaries, their capabilities, and their current or anticipated activities. Includes strategic intelligence (actor motivations and trends) and tactical...
- Traffic Light Protocol (TLP)
- A standardised colour-coded scheme for marking intelligence sharing restrictions. TLP:RED is for named recipients only; TLP:AMBER is for members' organisations; TLP:GREEN is...
- Volatility 3
- Open-source memory forensics framework, Python 3 rewrite of Volatility 2. Symbol-based (PDB symbols on Windows) instead of profile-based, supports modern Windows 10/11...
- YARA
- Pattern-matching language for malware classification. Rules combine string and byte-pattern conditions with metadata. Used by VirusTotal, every major sandbox, and most threat-intel...
Explained in these topics
- Intelligence Sources, Feeds and Sharing PlatformsA specific, observable artifact associated with malicious activity, such as a file hash, IP address, domain name, URL, or registry key. IOCs are the primary un...
- Malware Forensics: Static, Dynamic, Sandbox and Memory AnalysisObservable artefact linked to malicious activity. File hashes (MD5, SHA-256, ImpHash, ssdeep, TLSH), IPs, domains, URLs, registry keys, mutex names, named pipe...