Share:
Glossary Forensics

Indicator of compromise (IOC)

An indicator of compromise (IOC) is a piece of observable evidence, such as a file hash, IP address or domain, that suggests a system has been breached.

Last reviewed:

AdSense Placeholder
Slot: header_reference_page

In more detail

Security teams share IOCs from known attacks so others can search their logs and files for matches: a malicious file's Hash, a command-and-control address, an odd registry key or an unusual outbound connection. IOCs go stale as attackers change infrastructure, so behaviour-based detection complements them. Defang URLs when sharing them, with the URL Defanger.

Try these tools

URL Defanger

Defang URLs, domains, IP addresses and email addresses (hxxp://example[.]com) so they cannot be clicked by accident.

Hash Generator

Generate MD5, SHA-1, SHA-256, and SHA-512 hashes from any text, computed locally with the Web Crypto API.

Log Forensics

Parse Windows Event Log (.evtx) files and text logs - syslog, auth.log/secure, Apache/nginx access and error logs.

See also

  • Glossary Hash
    A hash is the fixed-length fingerprint a hash function computes from any input; the same input always gives the same hash.
  • Glossary Malware
    Malware is any software designed to harm a device or steal from its user, including viruses, worms, ransomware, spyware and trojans.
  • Glossary PCAP
    PCAP is the file format for storing captured network packets, produced by tools such as tcpdump and Wireshark for later analysis.
Back to Glossary
AdSense Placeholder
Slot: footer_leaderboard