IoC
acronymsecuritygovernance & risk
Stands for: indicator of compromise
A forensic artifact that indicates a system may have been breached: a hash, an IP, a domain, a filename, a registry key.
IoCs are how detection scales, since a SIEM can match millions of events against a feed of known-bad indicators automatically. Their weakness is their strength inverted: they are cheap for an attacker to change, a new domain or a recompiled binary defeats a signature instantly, which is why indicators sit at the bottom of the Pyramid of Pain and TTPs sit at the top. Good detection uses both, IoCs for speed and behavior for durability.
Also known as: indicator of compromise, indicators of compromise, IOCs