What is an indicator of compromise (IOC)?
NIST defines indicators of compromise as technical artifacts or observables that suggest an attack is imminent or currently underway, or that a compromise may have already occurred. In practice, an IOC is something specific you can search for in your logs: the hash of a malicious executable, the IP address of a command and control (C2) server or a phishing domain.
IOCs come from three main sources: your own investigations, threat intelligence (commercial, from sharing communities or from government agencies) and the reports that vendors and researchers publish on specific campaigns.
What types of IOCs are there?
| Type | Examples | Where you look for it |
|---|---|---|
| File hash | MD5, SHA-1 or SHA-256 of an executable, a document or a script | EDR, antivirus, email gateway, sandbox |
| IP address | IP of a C2 server, or the source of a scan or brute-force attack | Firewall, proxy, VPN and identity logs, NDR |
| Domain | Domain used for phishing or malware downloads, or generated by an algorithm (DGA) | DNS, proxy, email |
| URL | Specific download path or credential theft page | Proxy, email gateway, browser |
| Sender, sending domain, subject line or attachment name used in a campaign | Email gateway and mailboxes | |
| Host artifacts | Registry keys, scheduled tasks, services, mutexes, file paths and file names | EDR, system logs |
| Network artifacts | Anomalous user agent, TLS fingerprint (JA3 or JA4), C2 URI pattern | Proxy, NDR, firewall |
| Accounts and credentials | Accounts created by the attacker, credentials leaked by infostealers | Directory, identity logs, dark web intelligence |
What is the difference between an IOC and an IOA?
An IOC describes a specific artifact left behind by an attack, usually one that is already known. An IOA (indicator of attack) describes a behavior: a sequence of actions that reveals the attacker's intent, whatever tool they use.
| Aspect | IOC | IOA |
|---|---|---|
| What it describes | An artifact: hash, IP, domain, registry key | A behavior: what runs, in what order and for what purpose |
| Example | The SHA-256 of a specific ransomware loader | An Office document that launches PowerShell with an encoded command and then downloads a file |
| What it detects | Known, already documented threats | New variants of known techniques, even when the tools change |
| Shelf life | Short, especially for IPs and domains | Long, because changing techniques costs the attacker more |
| Risk | False negatives when the attacker changes the artifact | More false positives if the rule is too broad |
The two complement each other. IOCs are quick to apply and provide a high-confidence signal when they match a reliable, recent source. IOAs, which are usually mapped to MITRE ATT&CK techniques, cover what does not yet have an IOC.
What is the Pyramid of Pain?
The Pyramid of Pain was proposed by David J. Bianco in 2013 (he added the hash level in 2014) to rank indicators by how much it costs the attacker to replace them once you detect and block them. From bottom to top:
- Hash values: trivial to change. Modifying a single byte of the file is enough to get a different hash.
- IP addresses: the attacker can change them with very little effort, for example by using another cloud server or a proxy.
- Domain names: somewhat more costly, because they have to be registered, paid for and hosted.
- Network and host artifacts: patterns in traffic or traces on the system. Detecting them forces the attacker to reconfigure or recompile their tools.
- Tools: if you detect the tool rather than a specific version, the attacker has to find or develop another one.
- TTPs (tactics, techniques and procedures): detecting how the attacker operates forces them to change the way they work, which is the most costly change of all.
The practical takeaway: IOCs at the bottom are useful and cheap to apply, but a detection program that stops there only slows down the least prepared attackers. The higher up the pyramid you detect, the more expensive the attack becomes for the adversary.
How are IOCs used in detection and threat hunting?
- Real-time detection: you load IOCs into the EDR, firewall, proxy or SIEM so they trigger an alert or a block when they appear.
- Retrospective search: when a new IOC is published, you search your historical data to see whether it was already in your environment before it became known. This is where your log retention period matters.
- Alert enrichment: if an alert contains an IP or a hash that matches threat intelligence, its priority goes up and it gains context (threat actor, campaign, malware family).
- Starting point for hunting: an IOC from a campaign leads you to the technique it uses. From there, you formulate a hypothesis and search for the behavior as well as the artifact.
- Incident scoping: IOCs extracted from a compromised computer help you find other affected systems.
To exchange IOCs automatically, organizations use standards such as STIX (to describe them) and TAXII (to transport them), and platforms such as MISP. In the United States, for example, CISA offers the Automated Indicator Sharing (AIS) service, which participants connect to with a TAXII client to receive and share indicators in STIX format.
Do IOCs expire?
Yes, and forgetting this is one of the most common mistakes. An IP that is a C2 server today may host a legitimate service next week, especially with cloud providers and shared hosting. A domain may be taken over by researchers (sinkholed), or it may expire and end up registered by someone else. Blocking old indicators generates false positives and, in the worst case, cuts off legitimate services.
- Store the last-seen date of each IOC, as well as the date it was added.
- Define an expiration period by type. IPs lose value sooner, domains last somewhat longer, and hashes don't change, although they stop being useful when the attacker recompiles.
- Assign a confidence level based on the source and lower it over time. Platforms such as MISP include decay models to automate this.
- Check before blocking IPs that belong to CDNs, cloud providers or shared services. A single IP can serve thousands of legitimate sites.
- Track false positives per indicator and retire the ones that only generate noise.
How Ciberia helps
Ciberia Intel brings together our own and third-party threat intelligence (threat actors, campaigns, malware families, vulnerabilities, IOCs and reports, as well as credentials stolen by infostealers and activity on the dark web and forums). Ciberia Threat Hunting starts from hypotheses based on MITRE ATT&CK and runs retrospective searches for persistence and lateral movement, and its findings become new detection rules. This moves detection toward behaviors, at the top of the Pyramid of Pain.
