IOCs: The Digital Fingerprints Attackers Leave Behind

The 30-second explanation

Like fingerprints or footprints left at a crime scene, IOCs are the small traces an attacker leaves behind, which defenders can search for across their own systems.

How it works

1. 1

   1. Investigate

   Analysts dig into a confirmed incident.

2. 2

   2. Extract

   Hashes, domains and addresses get pulled out and noted.

3. 3

   3. Share

   The indicators get passed on to other defenders.

4. 4

   4. Search

   Everyone's logs get checked for the same traces.

When an incident gets investigated, analysts pull out the traces the attacker left: the fingerprint of a malicious file, the servers it phoned home to, the domain used in the phishing email that started it all. Those indicators of compromise then get shared, so other defenders can search their own logs for the same items before they're hit by the same campaign. Because attackers can change these fairly easily, IOCs make a fast, useful starting point but a weak long-term defence alone, which is why behaviour-based detection needs to sit alongside them.

Real-world example

How to spot it

• Expired indicators

  An old IOC may no longer even belong to the same attacker anymore.

• Shared infrastructure

  An address used by many innocent sites at once can trigger false alarms.

• One-off matches

  A single hit needs surrounding context before it justifies acting on.

• No source

  An indicator arriving with no explanation of where it came from.

What to do

1. 1Check the age and source of an indicator of compromise before blocking anything based on it.
2. 2Search historical logs as well as new ones; a match from last week still matters.
3. 3Pair IOCs with behavioural detections, since attackers can change indicators more easily than behaviour.