What is an indicator of compromise (IOC)?

An indicator of compromise is a piece of evidence that suggests a system has been attacked: an IP address or domain known to be used by attackers, the hash of a malicious file, a suspicious file name, the TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS. fingerprint of a known malware client, or a configuration change a piece of malware makes. Advisories from CISA, national CERTs and security researchers publish them so that others can search their own logs. They are useful and short-lived: attackers change servers and recompile their tools, so an address that was malicious last month may belong to someone innocent today. That is why indicators complement behaviour rather than replace it. Search your firewall, proxy and DNS logs for the indicators in any advisory that concerns you. From the Starter plan, NetSenX compares TLS handshakes with fingerprints of known malware where the agent captures packets, on Linux or as a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it./TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. sensor, and it flags behaviour such as beaconing on every plan.

← All 35 questions on Have I been hacked?All topics