What is an indicator of compromise?¶

An indicator of compromise is an artefact or characteristic associated with possible malicious activity.

Avoid the dangerous assumption¶

The dangerous assumption is that any match to an indicator proves that the system was compromised.

Indicators may include IP addresses, domain names, file hashes, filenames, registry entries, email addresses, URLs, process names, certificate details, user-agent strings or patterns of network traffic.

An indicator may come from an internal investigation, a security vendor, a government body, an industry partner or open-source threat intelligence.

Its value depends on context.

A file hash may identify an exact file. An IP address may have been used by an offender, but also by other users or services. A domain may once have hosted malicious content but later have changed ownership or purpose. A filename may be chosen by legitimate or malicious software.

Indicators also age. Infrastructure can be reassigned, files can be modified and attackers can change techniques.

Ask what the indicator represents, when it was observed, who assessed it, how specific it is, whether it is still current, what confidence attaches to it and what underlying activity matched.

An indicator is most useful when it helps locate evidence or connect events. It may support a wider conclusion when combined with process, account, device, timing and behavioural evidence.

Do not report a system as compromised merely because an indicator appeared in a log. Establish whether the contact, file or artefact was actually present, whether it was used and what consequence followed.

Operational takeaway¶

Use indicators to find and connect relevant activity, but assess their age, specificity and context before treating a match as evidence of compromise.