Also known as: IOC · IoC · indicators
An indicator of compromise (IOC) is an observable artifact — such as a file hash, IP address, domain, or registry key — that suggests a system may have been breached.
IOCs are the most easily shared form of threat intelligence and the most easily evaded. An attacker changes infrastructure and recompiles a payload trivially, invalidating hashes and addresses, which is why IOC-only detection is described as operating at the bottom of the 'pyramid of pain'.
Behavioural indicators — the techniques an adversary uses rather than the artifacts they leave — are far costlier for an attacker to change and correspondingly more durable as detections. IOCs remain valuable for rapid retrospective search after a disclosure.
MITRE ATT&CK
MITRE ATT&CK is a public knowledge base that catalogues real-world adversary tactics, techniques, and procedures, organised into a matrix that maps how attackers progress through an intrusion.
Threat Hunting
Threat hunting is the proactive search for attackers already present in an environment, driven by hypotheses about adversary behaviour rather than by alerts from automated detection tools.
SIEM
A SIEM (Security Information and Event Management) system centralises log and event data from across an organisation's infrastructure, correlating it to detect suspicious activity and support investigation.
Incident Response
Incident response is the structured process an organisation follows to detect, contain, eradicate, and recover from a security incident, and to learn from it afterwards.