# Indicator of Compromise (IOC)

A piece of forensic evidence, such as a file hash or IP address, that suggests a system may have been breached or infected.

An **indicator of compromise (IOC)** is a piece of forensic evidence, such as a suspicious file hash, an unusual outbound IP address[↗](/ip-address), a strange registry entry, or an unexpected login pattern, that suggests a system may have been breached or infected with malware[↗](/malware). Security teams collect and share IOCs to detect and investigate incidents.

IOCs are typically fed into security tools like SIEM platforms and antivirus[↗](/antivirus) software so that any matching activity triggers an automatic alert. Because attackers can change their tools quickly, IOCs are most powerful when combined with behavioral detection rather than used alone.