# What is an indicator of compromise (IOC)?

An indicator of compromise is a piece of evidence that suggests a system has been attacked: an IP address or domain known to be used by attackers, the hash of a malicious file, a suspicious file name, the TLS fingerprint of a known malware client, or a configuration change a piece of malware makes. Advisories from CISA, national CERTs and security researchers publish them so that others can search their own logs. They are useful and short-lived: attackers change servers and recompile their tools, so an address that was malicious last month may belong to someone innocent today. That is why indicators complement behaviour rather than replace it. Search your firewall, proxy and DNS logs for the indicators in any advisory that concerns you. From the Starter plan, NetSenX compares TLS handshakes with fingerprints of known malware where the agent captures packets, on Linux or as a SPAN/TAP sensor, and it flags behaviour such as beaconing on every plan.

FAQ: [Have I been hacked?](https://netsenx.com/en/faq/signs) · https://netsenx.com/en/faq/what-is-an-indicator-of-compromise

## Read next

- https://netsenx.com/en/is-someone-inside-your-network
- https://netsenx.com/en/detect-lateral-movement-c2-beaconing

## Related questions

- [Our antivirus shows everything green. Can we still be compromised?](https://netsenx.com/en/faq/antivirus-shows-green-can-we-still-be-compromised)
- [An administrator account appeared that nobody remembers creating. What now?](https://netsenx.com/en/faq/an-administrator-account-appeared-that-nobody-created)
- [A server sends data out at night. What should we check?](https://netsenx.com/en/faq/a-server-sends-data-out-at-night-what-to-check)
- [Our public IP address is on a blocklist. Does that mean we have been hacked?](https://netsenx.com/en/faq/our-ip-address-is-on-a-blocklist-are-we-hacked)
- [A colleague says the mouse moved by itself. Is someone controlling the computer?](https://netsenx.com/en/faq/the-mouse-moved-by-itself-is-someone-controlling-the-computer)