Indicators of compromise

An indicator of compromise is a fact tied to malicious activity: a file hash, an IP address, a domain, a URL pattern. Their value is not the single fact but the pivot — each IOC is a thread, and pulling it unravels infrastructure.

The big three, and how to pivot each

IP address: pivot to its provider and ASN, sibling hosts on the same infrastructure, and historical resolutions. Attackers reuse bulletproof hosting the way commuters reuse roads — one confirmed malicious IP often maps the whole operation. Check whois, passive DNS, and your own firewall logs for other internal hosts talking to the same address.

File hash (SHA-256): pivot to every machine that has seen it (EDR search), its signing certificate if any, and sandbox detonation for behavior. Hashes are exact-match — one changed byte makes a new hash — so pair them with behavioral signs (file paths, mutex names, network behavior) that survive small changes.

Domain/URL: pivot to registration (registrar, creation date, registrant patterns), name-server sharing, and certificate transparency for sibling domains. Freshly registered domains with login-themed names (secure-login-update.example) are a phishing tell worth memorizing.

Decay and blast radius

Every IOC type decays differently. IPs churn as attackers move (a block from last month may be a school today). Hashes break with a single changed byte. Domains persist while they resolve. Timestamp every IOC and expire them on a schedule — stale indicators cause false positives that train analysts to ignore the feed.

And every IOC needs a legitimacy check before you block on it: shared hosting, CDNs, and dynamic DNS mean someone innocent may live at the same address. Block the malicious use (the full URL, the specific binary), verify the blast radius first, and prefer narrow blocks with expiry over permanent wide ones.

IOCs vs behavior

Mature teams hunt behaviors (process trees, LOLBins usage, impossible travel) and use IOCs as confirmation, because behaviors survive infrastructure churn and IOCs do not. Learn both: IOCs for the quiz and the blocklist, behaviors for the detection engineering that actually scales.

Key takeaways

• Pivot every IOC: IPs → infrastructure, hashes → prevalence + behavior, domains → registration + siblings.
• Timestamp and expire indicators; stale IOCs cause alert fatigue.
• Check blast radius before blocking; prefer narrow, expiring blocks.