What is Indicator of compromise (IoC)?

A concrete trace showing that a system has been compromised, such as the hash value of a malware file, the IP address or domain name of a C2 server, or a characteristic file name. IoCs are shared between organizations and through threat intelligence and are matched against an organization's own logs and endpoints to check whether it has been hit by the same attack. Since attackers can easily change hash values and IP addresses, IoCs are combined with indicators of attack (IoA), which focus on attacker behavior, and with detection based on techniques.

Japanese name: IoC(侵害の痕跡)

Indicator of compromise (IoC) appears in 1 practice question across 1 topic, including Cyber Attacks and Defense in Practice.

Field: Cyber Attacks and Defense in Practice

Try it: questions about Indicator of compromise (IoC)

Which of the following correctly describes the IoC (indicator of compromise) and IoA (indicator of attack) used in threat detection?

AIoCs focus on the attacker's behavior and intent, while IoAs are concrete traces such as malware hash values and the IP addresses of C2 servers
BIoCs are concrete traces of a compromise such as malware hash values and the IP addresses of C2 servers, while IoAs focus on attacker behavior such as attempts to steal credentials
CBoth IoCs and IoAs express the severity of a vulnerability as a number from 0.0 to 10.0 and are used to decide the order in which to apply fixes

Show answer and explanation

Answer: B. IoCs are concrete traces of a compromise such as malware hash values and the IP addresses of C2 servers, while IoAs focus on attacker behavior such as attempts to steal credentials

An IoC (indicator of compromise) is a concrete trace showing that a compromise has occurred, such as the hash value of a malware file, the IP address or domain name of a C2 server, or a characteristic file name. IoCs are shared with other organizations and threat intelligence providers and matched against the organization's own logs and endpoints to check whether it has been hit by the same attack. However, attackers can easily change hash values and IP addresses, so IoCs are combined with IoAs (indicators of attack), which focus on behaviors that are harder for attackers to change, such as attempts to steal credentials or internal movement using legitimate tools.

Indicator of compromise (IoC) in the explanations

An IoC (indicator of compromise) is a concrete trace showing that a compromise has occurred, such as the hash value of a malware file, the IP address or domain name of a C2 server, or a characteristic file name.
Which of the following correctly describes the IoC (indicat…