# What is an Indicator of Compromise (IoC)?

> An indicator of compromise (IoC) is an observable artifact or condition that suggests malicious activity may be occurring or may have occurred.

- Canonical URL: https://yellowcube.eu/glossary/indicator-of-compromise/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Examples include a known-malicious file hash, an unexpected persistence entry, a suspicious domain, a command pattern, or a characteristic network connection.

An IoC is a lead, not automatic proof. Analysts must consider the source, context, timing, and possibility of legitimate reuse or deliberate deception. Some indicators — especially attacker-controlled infrastructure — change quickly, while artifacts tied to behavior may remain useful longer.

Indicators range from easily changed artifacts — file hashes, IP addresses, domains — to harder-to-fake behaviors such as tools, techniques, and sequences; disrupting behavioral indicators costs the adversary far more than rotating an address. Indicators also age: infrastructure is recycled and re-registered, so confidence scores, first and last observed times, and expiration rules matter as much as the indicator list itself.

### Key points

- **Primary purpose:** Support detection, threat hunting, scoping, and investigation.
- **Where it appears:** Endpoint, identity, email, network, cloud, application, and threat-intelligence data.
- **Good practice:** Record provenance, confidence, first and last observed times, context, and expiry or review conditions.
- **Important limitation:** A match can be false or historical, while the absence of a known IoC does not show that an environment is clean.

### Related terms

[Cyber threat intelligence (CTI)](<https://yellowcube.eu/glossary/cyber-threat-intelligence/>) · [Tactics, techniques, and procedures (TTPs)](<https://yellowcube.eu/glossary/tactics-techniques-and-procedures/>) · [Endpoint detection and response (EDR)](<https://yellowcube.eu/glossary/endpoint-detection-and-response/>) · [Network detection and response (NDR)](<https://yellowcube.eu/glossary/network-detection-and-response/>) · [Incident response (IR)](<https://yellowcube.eu/glossary/incident-response/>)

### Sources

[NIST glossary: Indicator of Compromise](https://csrc.nist.gov/glossary/term/indicator_of_compromise) · [OASIS: STIX Indicator object](https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_muftrcpnf89v)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.