Category hub: Detection, monitoring and response

In one sentence: Indicators of compromise are the clues left behind by an attack, such as a known bad web address or an odd new account, that tell you someone may have broken in.

What are indicators of compromise?

NIST defines an indicator of compromise (IOC) as technical artifacts or observables that suggest an attack is imminent or underway, or that a compromise may already have occurred. The word “suggest” matters. An IOC is a clue, not proof.

NIST’s control guidance (SP 800-53) gives examples: the creation of registry key values, and, for network traffic, web addresses or protocol elements that point to malicious command-and-control servers. It says sharing IOCs quickly can reduce the time organisations stay vulnerable to the same attack.

How it works

1. Someone investigates an incident and notes what the attacker left: file fingerprints, addresses, account changes.
2. Those clues are shared, for example in government advisories.
3. You compare them with your own logs, email and security tools.
4. A match is a lead. You investigate, contain and clean up if it is real.
5. Old IOCs go stale. Attackers can change them easily. A joint NSA, CISA, FBI and NCSC advisory says IOCs can be easily altered to bypass IOC-based mitigation.

An IOC list tells you about known attacks only. No match does not prove you are clean.

Who it affects and how badly

Every organisation that keeps logs can use IOCs.

• Sole trader to 10 staff: you mostly rely on your email and endpoint tools to apply IOCs for you.
• 10 to 250 staff (MSP clients, accountancy, manufacturing): an MSP or SOC can check advisories against your logs. Without that, a break-in can go unnoticed.
• 250 plus and regulated firms: IOC matching feeds incident response and breach reporting. Missing early clues can lengthen outages and enlarge a reportable breach.

Real examples

The July 2021 joint advisory from the NSA, CISA, FBI and NCSC on a Russian GRU brute force campaign lists IP addresses and a detection rule as IOCs for defenders to check: advisory PDF.

How to detect it

IOCs are how you detect. Common places to look:

• Accounts: sign-ins from unusual places, new MFA devices, many failed sign-ins.
• Email: new inbox rules or forwarding. Microsoft says malicious inbox rules are widely common during business email compromise and phishing campaigns, and has an alert-grading guide.
• Network: connections to addresses named in advisories.
• Systems: new services, scheduled tasks or unknown programs.

In Microsoft 365, use Defender alerts, Entra sign-in logs and the audit log. Keep logs long enough to look back.

How to fix or prevent it

1. Turn on and keep logs: Entra sign-in logs, the Microsoft 365 audit log and endpoint logs.
2. Subscribe to NCSC and CISA advisories and check new IOCs against your logs.
3. Use a monitored service, such as managed detection, that checks IOCs for you.
4. Do not rely on IOCs alone. Add alerts for unusual behaviour.
5. Have an incident response plan so a match leads to a defined action.
6. When you find IOCs, record them and share them with your provider and, where appropriate, the NCSC.

Related terms

• threat-intelligence
• siem
• incident-response
• log-retention
• cisa-kev
• infostealer-malware

Also read: access-bypass, brute-force-attack.

Frequently asked questions

What are indicators of compromise?
They are the clues left behind by an attack, such as a known bad web address or an odd new account, that suggest someone may have broken in.

Does no IOC match mean I am safe?
No. An IOC list tells you about known attacks only, and attackers can change IOCs easily.

Where should I look for IOCs?
Look at accounts, email rules and forwarding, network connections to advertised addresses, and new services or unknown programs on systems.

How Wolfcore helps

Wolfcore’s vulnerability management and SOC monitoring keep watch for this after the test is over. See Wolfcore SOC monitoring and vulnerability management.

Service page: Wolfcore SOC monitoring.