Indicators of Compromise Explained

An Indicator of Compromise (IOC) is a piece of digital forensics that suggests that an endpoint or network may have been breached. Just as with physical evidence, these digital clues help information security professionals identify malicious activity or security threats, such as data breaches, insider threats or malware attacks.

Investigators can gather indicators of compromise manually after noticing suspicious activity or automatically as part of the organization’s cybersecurity monitoring capabilities. This information can be used to help mitigate an in-progress attack or remediate an existing security incident, as well as create “smarter” tools that can detect and quarantine suspicious files in the future.

Unfortunately, IOC monitoring is reactive in nature, which means that if an organization finds an indicator, it is almost certain that they have already been compromised. That said, if the event is in-progress, the quick detection of an IOC could help contain attacks earlier in the attack lifecycle, thus limiting their impact to the business.

As cyber criminals become more sophisticated, indicators of compromise have become more difficult to detect. The most common IOCs—such as an md5 hash, C2 domain or hardcoded IP address, registry key and filename—are constantly changing, which makes detection more difficult.

How to Identify Indicators of Compromise

When an organization is an attack target or victim, the cybercriminal will leave traces of their activity in the system and log files. The threat hunting team will gather this digital forensic data from these files and systems to determine if a security threat or data breach has occurred or is in-process.

Identifying IOCs is a job handled almost exclusively by trained infosec professionals. Often these individuals leverage advanced technology to scan and analyze tremendous amounts of network traffic, as well as isolate suspicious activity.

The most effective cybersecurity strategies blend human resources with advanced technological solutions, such as AI, ML and other forms of intelligent automation to better detect anomalous activity and increase response and remediation time.

Why Your Organization Should Monitor for Indicators of Compromise

The ability to detect indicators of compromise is a crucial element of every comprehensive cybersecurity strategy. IOCs can help improve detection accuracy and speed, as well as remediation times. Generally speaking, the earlier an organization can detect an attack, the less impact it will have on the business and the easier it will be to resolve.

IOCs, especially those that are recurring, provide the organization with a window into the techniques and methodologies of their attackers. As such, organizations can incorporate these insights into their security tooling, incident response capabilities and cybersecurity policies to prevent future events.

Examples of Indicators of Compromise

What are the warning signs that the security team is looking for when investigating cyber threats and attacks? Some indicators of compromise include:

• Unusual inbound and outbound network traffic
• Geographic irregularities, such as traffic from countries or locations where the organization does not have a presence
• Unknown applications within the system
• Unusual activity from administrator or privileged accounts, including requests for additional permissions
• An uptick in incorrect log-ins or access requests that may indicate brute force attacks
• Anomalous activity, such as an increase in database read volume
• Large numbers of requests for the same file
• Suspicious registry or system file changes
• Unusual Domain Name Servers (DNS) requests and registry configurations
• Unauthorized settings changes, including mobile device profiles
• Large amounts of compressed files or data bundles in incorrect or unexplained locations

The Difference Between Indicator of Compromises (IoCs) and Indicators of Attack (IoAs)

An Indicator of Attack (IOA) is related to an IOC in that it is a digital artifact that helps the infosec team evaluate a breach or security event. However, unlike IOCs, IOAs are active in nature and focus on identifying a cyber attack that is in process. They also explore the identity and motivation of the threat actor, whereas an IOC only helps the organization understand the events that took place.