What Is an Indicator of Compromise (IOC)?

Definition

Indicators of compromise (IOCs) are the digital clues that show an attack is coming, is happening, or has already happened: a known-bad file, a suspicious IP address, an odd file extension, a strange login. NIST defines them as "technical artifacts or observables" that suggest an attack is imminent or underway, or that a compromise may already have occurred.

How It Works

Common IOC types include:

Files: names, paths, and cryptographic hashes of known malware or webshells.
Network: IP addresses, domains, and URLs used by attackers for logins, downloads, or command and control.
Host artifacts: new services, scheduled tasks, registry keys, or admin accounts nobody created.
Email: sender addresses, lookalike domains, subject lines, and attachment names from a phishing campaign.
Behavior in logs: a burst of failed logins, a login from an unusual country, or an image file receiving POST requests.

IOCs come from two directions. Inside: your own logs, antivirus and EDR alerts, and what responders find on an infected system. Outside: government advisories and threat feeds, such as CISA's #StopRansomware advisories, which publish IOCs in readable tables and in STIX and JSON formats that security tools can import. Responders then search every system for matches to scope the incident.

NIST SP 800-61 Revision 2 also separates a precursor (a sign an incident may happen later, such as a vulnerability scan against your site) from an indicator (a sign one may already have happened). It warns that indicators can be wrong, and that even an accurate one does not always mean an incident: a server crash or a changed file can have innocent causes, so each one needs checking.

Real-World Example

FBI and CISA advisory AA23-061A on Royal ransomware, which later rebranded as BlackSuit, shows what published IOCs look like. Its first table lists .royal as the encrypted file extension and README.TXT as the ransom note. Further tables list attacker IP addresses with the month each was last seen, plus tools and file hashes. The advisory also includes a caution worth copying into any IOC process: some of the IP addresses are several years old, so vet them before you block them.

IOCs flow the other way too. In Senate testimony after its 2021 ransomware attack, Colonial Pipeline said it contacted the FBI the morning of the attack and proactively shared indicators of compromise with law enforcement to help others defend against the same group.

Why It Matters for a Small Business

You do not need a security operations center to use IOCs. A single published advisory can tell you which file names, extensions, and addresses to search for on your own servers and websites. When something does go wrong, the IOCs you collect let a responder check every other system you own, answer an insurer's questions about scope, and give law enforcement something concrete. The limit is that IOCs describe attacks someone has already seen. A careful attacker changes file names and IP addresses, which is why responders also look at behavior, not just lists.

How to Spot It / How DTS Handles It

Things worth checking on any suspected compromise: unfamiliar files in web folders, new admin users, logins from unexpected locations, outbound connections to addresses you do not recognize, and file extensions you have never seen.

During an investigation DTS records every IOC it finds (file hashes, attacker IPs from access logs, rogue usernames, injected domains), searches all of your other systems and sites for the same markers, and hands the list to you, your insurer, or law enforcement. See our incident response service and the WordPress compromise checklist.

Related Terms

Incident response: the process IOCs feed into.
Triage: deciding which indicators are real and urgent.
Indicators of attack (IOA): behavior-based clues that catch attacks IOC lists miss.
Webshell: a file-based IOC you can hunt for on any website.
Containment: what you do once IOCs confirm a compromise.
Security logging: without logs there are few indicators to find.

Sources

NIST CSRC Glossary, "Indicator of Compromise" (definition from NIST SP 800-61r3, adapted from SP 800-150): https://csrc.nist.gov/glossary/term/indicator_of_compromise
NIST, SP 800-61 Rev. 2, Computer Security Incident Handling Guide (Section 3.2.2, Signs of an Incident; withdrawn April 3, 2025 and superseded by Rev. 3): https://csrc.nist.gov/pubs/sp/800/61/r2/final
FBI and CISA, Cybersecurity Advisory AA23-061A, #StopRansomware: BlackSuit (Royal) Ransomware (last revised August 27, 2024): https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-061a
Testimony of Joseph Blount, Colonial Pipeline, Senate HSGAC (June 8, 2021): https://www.hsgac.senate.gov/wp-content/uploads/imo/media/doc/Testimony-Blount-2021-06-08.pdf

Last updated October 14, 2026.