TopicCybersecurity →
Simple definition
An observed indicator that may indicate compromise.
Technical definition
The tool can be a file, domain, IP address, registry key, path or other artifact associated with a malicious activity.
What is it used for ?
Quickly search for common traces on several systems.
Practical example
After an incident, a team can search the entire park for the ish of an identified malicious file.
Common issues
- IOC become obsolete
- False positive on shared infrastructure
- Research without behavioural context
Related terms
Key takeaway: This entry explains the general operation of the term. Exact settings may vary depending on software, vendors and environments.