How to Analyze an Indicator of Compromise (IOC)
A practical workflow for analyzing IOCs: identify the type, normalize and defang, check against threat intelligence, and avoid the trap of treating 'no record' as 'safe'.
Quick Answer
An indicator of compromise (IOC) is any observable artifact — such as an IP, domain, URL, email address or file hash — that may signal malicious activity; defending against stray 'no record' conclusions requires verifying from threat-intelligence sources.
Definition
IOC analysis is the process of classifying, normalizing and checking observable artifacts against threat intelligence to determine whether they are associated with known malicious activity.
Answer first
Classify the indicator, normalize/defang it, check it against intelligence, and never assume “no record” means safe.
1. Identify the type
A value can be an IP address, domain, URL, email address or file hash (MD5/SHA-1/SHA-256). Recognizing the type tells you which sources are relevant.
2. Normalize and defang
Normalize case and strip defanging (for example, replace evil[.]example[.]com with evil.example.com). Always work on a defanged copy when sharing in plain text to avoid accidental clicks.
3. Check threat intelligence
Look the value up in threat-intelligence feeds and the OpenTrojan knowledge base. Look for known family attribution, related campaigns and published references.
4. Interpret honestly
A legitimate-looking value with no record is not confirmed safe — it is unconfirmed. Only report confirmed matches with a traceable source, and always add the caveat.
5. Continue the loop
For a confirmed match, follow the related intelligence to the entity, read evidence, and start an investigation.
Tools that help
- IOC Lookup — detect, normalize and check indicators.
- Hash Checker — identify and check file hashes.
- URL Analyzer — inspect URL structure locally.
References
Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.