What is Indicator of compromise (IOC)?

An indicator of compromise (IOC) is evidence that a system, network, account, or device may have been breached or exposed to malicious activity. Security teams use IOCs to detect known threats, investigate incidents, hunt for attacker behavior, and strengthen defenses before damage spreads.

IOCs are usually technical clues left behind by malware, phishing, credential theft, command-and-control activity, or unauthorized access. They do not always prove an active breach on their own, but they give analysts a starting point for validation.

Common types of indicator of compromise (IOC)

IOCs can appear across endpoints, networks, identities, cloud environments, and applications. The most useful indicators are specific enough to investigate and relevant enough to act on.

Why IOCs matter in threat intelligence

In threat intelligence, IOCs help translate attacker activity into signals that security tools can search for. They make it easier to identify whether an organization has been targeted by a known campaign, malware family, phishing kit, or adversary infrastructure.

However, IOCs are often short-lived. Attackers can rotate domains, change file hashes, use new infrastructure, or hide behind legitimate services. That is why mature security programs combine IOCs with behavioral analytics, tactics, techniques, and procedures, often mapped to frameworks such as MITRE ATT&CK.

How security teams use IOCs

Security teams use IOCs in several practical ways:

• Detect known malicious files, URLs, IP addresses, and domains.
• Search historical logs during incident response.
• Prioritize alerts based on threat context.
• Enrich endpoint, network, SIEM, and EDR detections.
• Support threat hunting by giving analysts concrete leads.

For endpoint-heavy environments, unified endpoint management and security platforms can help reduce exposure by enforcing configurations, isolating risky devices, and supporting faster investigation. Hexnode, for example, can support device visibility and policy enforcement that complement IOC-driven response.

IOC vs indicator of attack

An IOC usually points to evidence that compromise may already have occurred. An indicator of attack focuses on attacker behavior that may still be unfolding, such as lateral movement, credential misuse, or privilege escalation.

Both are useful. IOCs are strong for matching known threats, while behavior-based indicators help detect new or modified attacks that do not match existing signatures.