Indicators of compromise (IOCs) are technical artifacts or observables (opens in new tab) that suggest an attack is imminent, currently underway, or has already occurred. IOCs are retrospective by nature (opens in new tab): they record what an attacker left behind, while an indicator of attack (IOA) flags malicious behavior that is still in progress.
How indicators of compromise work
An IOC begins as an observable, an event on a network or system. Analysts turn it into an indicator by attaching context, such as which malware family the hash belongs to or which campaign the domain serves. Canonical examples (opens in new tab) include the IP address of a suspected command-and-control server, a suspicious DNS domain, and the hash of a malicious executable.
Security teams gather indicators from threat intelligence reports (opens in new tab), commercial and open-source feeds, internal tools, and peer-sharing communities, then score each indicator (opens in new tab) against their own threat model and environment before trusting it.
Security teams exchange indicators in structured formats. They use STIX to describe (opens in new tab) the intelligence and TAXII to transport it (opens in new tab), while the open-source MISP platform stores and correlates indicators (opens in new tab) and supports IDS/SIEM exports (opens in new tab).
A widely distributed supply-chain backdoor shows the workflow in practice. Malicious IP addresses, backdoor file hashes, and domains such as deftsecurity[.]com appeared in CISA advisory AA20-352A (opens in new tab). Teams that ingested those indicators had what they needed to sweep historical logs (opens in new tab) for matches and rule compromise in or out in their own environment.
Why indicators of compromise matter
IOC-driven detection (opens in new tab) helps incident responders detect, diagnose, halt, and remediate malicious activity. Machine-readable indicators move between public and private-sector organizations in real time through Automated Indicator Sharing (opens in new tab), while state, local, tribal, and territorial government members receive curated STIX/TAXII feeds (opens in new tab) from MS-ISAC at no cost.
The value of shared and internally collected indicators varies sharply by type. The 2013 Pyramid of Pain (opens in new tab) ranks indicators by how much it costs an attacker to change them. An attacker can swap a hash value (opens in new tab) trivially and rotate an IP address or a domain with little more effort. Changing attacker TTPs (opens in new tab) is much harder.
Runtime code generation and infrastructure rotation make atomic IOCs less durable. AI-enabled malware has moved from proof-of-concept to practice: through runtime code generation (opens in new tab) it produces malicious logic on the fly to evade traditional signatures, and residential proxies (opens in new tab) let adversaries operate from trusted home and business IP space.
Programs that weight atomic IOC matching heavily need behavioral and TTP-level detection (opens in new tab) alongside them.
Types of indicators of compromise
Practitioners group IOCs by where the artifact appears:
- Network-based IOCs. Connections to known command-and-control IP addresses and suspicious URI and user-agent strings, plus anomalous DNS traffic (opens in new tab), remote-access protocol use (opens in new tab), and unusual web traffic catalogued in CISA advisory AA20-245A.
- Host-based IOCs. Suspicious running processes, unexpected scheduled tasks, mutex objects (opens in new tab), and persistence entries such as registry Run Keys (opens in new tab) that malware families including Conficker and Cobalt Group tooling use.
- File-based IOCs. Hashes of malicious executables include MD5 and SHA-1, with SHA-256 also in use. Other examples include filenames, file paths, and embedded strings. A SHA-256 hash for def.exe, a suspected BianLian backdoor, appeared in CISA's BianLian ransomware advisory (opens in new tab).
- Email and identity IOCs. These include suspicious email authentication or routing signals. Anomalous login activity and MFA bypass attempts (opens in new tab) also belong in this category.
- External and brand-facing IOCs. Lookalike domain registrations (opens in new tab), newly issued certificates in Certificate Transparency logs, fake social profiles (opens in new tab), spoofed mobile apps (opens in new tab), and malvertising infrastructure (opens in new tab).
These signals surface outside the corporate perimeter, often before a campaign launches against customers or employees.
How to operationalize indicators of compromise
Start with feed discipline. Add feeds gradually, evaluate each feed's context and false positives, and score indicators (opens in new tab) using your threat model, source reliability, environment, and operational context. Decay policies should vary by type.
Atomic indicators (opens in new tab) such as IP addresses can go stale quickly, while durable artifacts and behavioral rules live far longer. Retiring outdated indicators matters as much as ingesting new ones, since obsolete entries degrade performance (opens in new tab) and generate false positives (opens in new tab).
Then automate the matching. Run automated IOC sweeps (opens in new tab) of SIEM indexes against active indicators. Map indicators to MITRE ATT&CK techniques and use the framework's Detection Strategies (opens in new tab) when developing longer-lived analytic rules; the same indicators feed forward as standing detections against newly ingested data.
Extend collection to the external surface (opens in new tab) too. Monitor domain registrations (opens in new tab) and certificate logs for impersonation infrastructure before it goes live. Behavioral hunting (opens in new tab) covers what the atomic list misses, including novel tooling and infrastructure that has not yet appeared in published intelligence.
How Doppel helps
Doppel is the AI-native Social Engineering Defense (opens in new tab) (SED) platform that unifies Digital Risk Protection (opens in new tab) and Human Risk Management. The platform extracts indicators from inbound abuse reports (opens in new tab) and correlates them against broader attacker infrastructure (opens in new tab).
The company built the Doppel Threat Graph (opens in new tab) to expose the full architecture of an impersonation campaign (opens in new tab). It connects spoofed domains, fake profiles, scam ads, and malicious texts (opens in new tab) into a single interactive graph. This turns isolated external IOCs into a campaign-level view (opens in new tab) of the infrastructure behind them.
Doppel's agentic AI (opens in new tab) correlates signals, prioritizes threats, and executes takedowns (opens in new tab) across registrars, social platforms, ad networks, telcos, and paid ads (opens in new tab), while expert analysts handle escalations that require human judgment. Completed actions strengthen campaign correlations across the customer network and reduce how long attacker domains, fake profiles, and malicious ads remain active.
Request a demo (opens in new tab) to see how live impersonation IOCs correlate against your brand.
Frequently asked questions about indicators of compromise
What is an indicator of compromise (IOC)?
An indicator of compromise is a technical artifact or observable (opens in new tab) suggesting that an attack is imminent, in progress, or has already happened. Common IOCs include file hashes tied to known malware, IP addresses of command-and-control servers, suspicious domain names, and anomalous login activity. Incident responders use them as forensic clues (opens in new tab) to detect, diagnose, halt, and remediate malicious activity in their networks.
What are indicators of compromise in cybersecurity?
In cybersecurity, indicators of compromise are technical artifacts that signal possible attacker activity. Security operations teams use security information and event management (SIEM) tools to match them against telemetry, supporting both retroactive and proactive hunts. Custom threat scoring prioritizes indicators by source, type, attributes, and context rather than generic vendor scores. Analysts write detection rules and hunting queries from the same artifacts, then use a confirmed hit to scope an incident: which systems attackers touched, which accounts they accessed, and over what window. Validated indicators then go to partners and information sharing and analysis centers (ISACs) in the structured STIX and TAXII formats, short for Structured Threat Information Expression and Trusted Automated Exchange of Intelligence Information.
What is the difference between an IOC and an IOA?
An indicator of compromise (IOC) is retrospective forensic evidence: finding one means an attack has likely already touched the environment. An indicator of attack (IOA) is a behavioral signal that identifies malicious activity while the attack is still in progress. IOCs excel at catching known threats and infrastructure, while IOAs detect novel methods and zero-days by focusing on behavior rather than fixed signatures. Lifespan differs by type: IP addresses and domains can rotate quickly because attackers replace them cheaply, while behavioral indicators and attacker tactics last far longer. Mature security programs use both.
What are examples of indicators of compromise?
A known-malware hash (opens in new tab), traffic to a documented command-and-control IP, and a registry persistence key planted by a backdoor are classic examples. Outside the corporate network, newly registered lookalike domains and fresh certificates issued for brand-imitating hostnames are IOCs for impersonation campaigns, as are fake social media profiles using a company's logo and spoofed mobile apps. Each of these artifacts only helps while the attacker keeps using it, which is why teams retire stale entries and back the list with behavioral detection.