IoC (Indicator of Compromise)
Definition
Observable artefact linked to malicious activity. File hashes (MD5, SHA-256, ImpHash, ssdeep, TLSH), IPs, domains, URLs, registry keys, mutex names, named pipes, scheduled task names, service names. Shared between organisations using STIX (data model) over TAXII (transport).
- Category
- Digital forensics / threat intelligence
- Common types
- File hashes, IPs, domains, URLs, registry keys, mutex names
- Sharing model
- STIX data model transported over TAXII
- Typical hash algorithms
- MD5, SHA-256, ImpHash, ssdeep, TLSH
Common questions
Why use fuzzy hashes like ssdeep or TLSH alongside MD5 or SHA-256?+
Cryptographic hashes such as MD5 and SHA-256 change completely if even one byte of the file changes, so a repacked or slightly modified malware sample produces no match. Fuzzy hashes like ssdeep and TLSH measure similarity rather than exact identity, so they can flag a variant of a known sample even after minor edits.
How reliable is a single IoC match on its own?+
A single indicator such as an IP address or domain can be reused by unrelated actors, hosted on shared infrastructure, or become stale once an attacker rotates it. Analysts usually corroborate IoCs against multiple sources and combine them with behavioural indicators before treating a match as conclusive evidence of compromise.
Related terms
- Entropy (Shannon)
- Per-byte information density of a file or section. Plain code sits around 5.5; packed or encrypted sections exceed 7.0. A PE with...
- ImpHash
- Mandiant's hash of the ordered list of imported functions in a PE file's import table. Survives recompilation that does not change imports;...
- ISAC (Information Sharing and Analysis Center)
- A sector-specific membership organisation that collects, analyses, and redistributes threat intelligence among its members under confidentiality agreements. Examples include FS-ISAC (financial services),...
- PE (Portable Executable) Header
- The Windows executable file format. Starts with an MZ DOS stub, points to a PE signature, then a COFF file header, an...
- STIX (Structured Threat Information eXpression)
- An OASIS open standard that defines a JSON-based language for describing cyber threat intelligence. STIX 2.1 defines objects for indicators, threat actors,...
- TAXII (Trusted Automated eXchange of Indicator Information)
- An OASIS open standard that defines an HTTPS-based protocol for transporting STIX content between organisations. A TAXII server exposes collections; clients poll...
- Threat Intelligence
- Processed, analysed information about adversaries, their capabilities, and their current or anticipated activities. Includes strategic intelligence (actor motivations and trends) and tactical...
- Traffic Light Protocol (TLP)
- A standardised colour-coded scheme for marking intelligence sharing restrictions. TLP:RED is for named recipients only; TLP:AMBER is for members' organisations; TLP:GREEN is...
- Volatility 3
- Open-source memory forensics framework, Python 3 rewrite of Volatility 2. Symbol-based (PDB symbols on Windows) instead of profile-based, supports modern Windows 10/11...
- YARA
- Pattern-matching language for malware classification. Rules combine string and byte-pattern conditions with metadata. Used by VirusTotal, every major sandbox, and most threat-intel...
Explained in these topics
- Intelligence Sources, Feeds and Sharing PlatformsA specific, observable artifact associated with malicious activity, such as a file hash, IP address, domain name, URL, or registry key. IOCs are the primary un...
- Malware Forensics: Static, Dynamic, Sandbox and Memory Analysis