IOC

Definitions

1. Short for indicator of compromise, an observable artifact such as a file hash, IP address, registry key, or domain associated with known malicious activity. IOCs are valuable for matching known threats, but they are less durable than behavioral detections when attackers change tooling quickly.

   In plain English: A specific artifact that suggests a system may already be compromised.

   Example: "The team blocked the IOC list from the intel feed, then hunted for related behavior across endpoints."

Related Terms

• Honeypot
• Attack Playbook
• Automated Threat Detection
• Canary
• Continuous Monitoring
• Detection Rule
• Indicator
• Indicator Management
• Intelligence Sharing
• IOA
• IP Intelligence
• Javelina
• Runtime Protection