Indicator of Compromise (IOC)

An indicator of compromise (IOC) is a piece of forensic evidence, such as a suspicious file hash, an unusual outbound IP address↗, a strange registry entry, or an unexpected login pattern, that suggests a system may have been breached or infected with malware↗. Security teams collect and share IOCs to detect and investigate incidents.

IOCs are typically fed into security tools like SIEM platforms and antivirus↗ software so that any matching activity triggers an automatic alert. Because attackers can change their tools quickly, IOCs are most powerful when combined with behavioral detection rather than used alone.