IOC (Indicators of Compromise)
Indicators of compromise (IOCs) are pieces of forensic evidence that suggest a system or network has been breached, such as malicious file hashes, IP addresses, domains, URLs or registry keys. Security teams use IOCs to detect known threats, scope incidents and share threat intelligence, though modern detection increasingly complements them with behavioural indicators.
Indicators of compromise are the observable artefacts that signal a security breach may have occurred or is occurring. They are the digital equivalent of forensic evidence: a file hash matching known malware, an IP address or domain associated with an attacker’s infrastructure, a suspicious URL, an unexpected registry key, or a distinctive pattern in logs. Security teams collect, share and search for IOCs to detect known threats and to determine whether a specific attack has touched their environment.
IOCs come in several types. Network indicators include malicious IP addresses, domains and URLs used for command and control or data exfiltration. Host indicators include file hashes, filenames, registry keys and processes associated with malware. Others include email addresses used in phishing and specific strings found in malicious code. Each is a concrete, matchable value, which is what makes IOCs so useful for automated detection: a tool can check whether any of these values appears in the environment.
A major use of IOCs is threat intelligence sharing. When one organisation or researcher analyses an attack, the IOCs they extract can be shared, through feeds, communities and standards, so that others can search for the same threat proactively. This collective defence means an attack seen against one target can be detected across many others. Precursor’s threat intelligence aggregates and enriches IOC data from sources such as the ThreatFox feed, making it queryable for exactly this purpose.
It is useful to distinguish indicators of compromise from indicators of attack. IOCs are evidence that a compromise has already happened, found after or during an event. Indicators of attack focus on the behaviour and intent of an attack in progress, aiming to catch it earlier. Both are valuable, and mature detection uses them together, but the distinction reflects a wider shift in the industry from reacting to known artefacts toward recognising adversary behaviour.
The limitation of IOCs is that they describe known threats. Attackers routinely change infrastructure, recompile malware to alter its hash, and rotate domains, so a purely IOC-based defence is always chasing yesterday’s attack. This is why IOCs are increasingly complemented by behavioural detection and by mapping to adversary techniques via frameworks like MITRE ATT&CK, which are harder for an attacker to change than a single address or hash. IOCs remain essential for detecting and scoping known threats; they are one layer, not the whole defence.
The limitation of indicators is that they describe known threats, and attackers change infrastructure and recompile malware constantly, so a purely indicator-based defence always trails the latest attack. This is why indicators are increasingly paired with behavioural detection and with adversary techniques mapped to MITRE ATT&CK, which are far harder to change than a single address or hash. Indicators remain essential for detecting and scoping known threats, as one layer among several.
Precursor makes enriched IOC intelligence queryable through its platform and MCP server, and uses it alongside behavioural detection in its managed SOC, so both known indicators and novel adversary behaviour are covered.