Indicators of compromise: what they are

In short

When an attack is analysed, the people studying it extract its recognisable elements and share them: "if you find this file on your systems, or a connection to this domain, you have probably been hit too". IoCs are therefore a checklist to compare against your own logs and systems.

How it works

The most common types are:

• fingerprints (hashes) of malicious files, for example SHA-256;
• IP addresses, domains and URLs of command-and-control servers or phishing pages;
• email addresses and message subjects used in a campaign;
• host artefacts: names of files and services, registry keys, scheduled tasks created by the malware.

IoCs are exchanged in CSIRT bulletins, researchers' reports and threat intelligence feeds, often in structured formats such as STIX, and with a TLP label that says who they can be shared with.

Why it matters, and the limits

IoCs let you answer a concrete question quickly: "have we been touched by this campaign?". But they age fast. An attacker changes a file's hash by recompiling it, and changes IP address in a few minutes. The researcher David Bianco described the problem with the "pyramid of pain": the indicators easiest to collect (hashes, IPs) are also the easiest for the attacker to change; the most useful ones are tools and behaviours, that is, the techniques described in MITRE ATT&CK.

That is why IoCs are complemented by indicators of attack (IoA), which describe suspicious behaviour as it happens, for example an Office document launching a script, regardless of the file used.

Example

The Italian national CSIRT publishes an advisory on a campaign targeting Italian companies with fake invoices: it lists three domains, two IP addresses and the fingerprints of the attachments. The IT lead searches for those values in the firewall and endpoint logs for the last thirty days and finds a connection to one of the domains from a PC in the accounts department, two weeks earlier. Without retained logs the search would have been impossible; with the logs, the PC is isolated and analysed before the compromise spreads.

Related terms

• Threat hunting
• SIEM
• File Integrity Monitoring
• CSIRT