What is an Indicator of Compromise (IOC)?
An indicator of compromise (IOC) is forensic evidence — an IP, domain, URL, hash or other artifact — observed in malware or attack activity. Learn the IOC types, lifecycle and how to use them without treating a lookup as a verdict.
Quick Answer
An indicator of compromise (IOC) is a concrete artifact — IP address, domain, URL, file hash, email address or other observable — associated with known malicious or suspicious activity. IOCs power detection and triage, but a lookup result is only a lead: a match shows where the artifact was seen, while no record simply means no known coverage. Use IOCs to enrich an investigation, never as a standalone threat verdict.
Definition
An indicator of compromise (IOC) is a technical artifact — such as a network address, domain, URL, file hash or email identifier — that is associated with malicious or suspicious activity and can be used to detect, correlate and triage potential intrusions.
Answer first
An IOC is evidence, not a verdict. It is a concrete artifact linked to known malicious activity — an address, a domain, a URL, a hash. Use it to start collection and correlation; never let a single lookup decide.
Overview
An indicator of compromise (IOC) is any technical artifact that has been observed in connection with malicious or suspicious activity. Indicators are the atomic building blocks of threat intelligence: they let defenders match their own logs and telemetry against what is known about attacks, malware families, actors and campaigns.
Types of IOCs
Common indicators OpenTrojan handles:
- IPv4 / IP ranges — command-and-control servers, scanners, hosting infrastructure.
- Domains — phishing pages, payload delivery, lookalike registrations.
- URLs — exact phishing or download links (most specific, least noisy).
- File hashes — MD5 / SHA-1 / SHA-256 of known malware samples.
- Email identifiers — sender addresses, subjects, envelope metadata.
- Other artifacts — TLS certificates, User-Agents, crypto wallet addresses, YARA rules.
Specificity matters: an exact hash is far less noisy than a shared-hosting IP.
Why IOCs matter
IOCs translate intelligence into action. A domain observed in a confirmed campaign lets you search your proxy and mail logs; a hash lets you search your endpoint fleet; an IP lets you check firewall and DNS records. Without indicators, intelligence stays abstract.
IOC lifecycle
- Collection — capture artifacts from a sample, phishing kit, campaign report or incident.
- Normalization — convert to a canonical form (lowercase domains, defanged URLs).
- Enrichment — relate the indicator to entities: malware family, actor, campaign, CVE.
- Matching — compare against telemetry and other records.
- Judgement — decide on evidence, never on the match alone.
What a record (or no record) means
- Match: the artifact has been seen before and links to related entities. A starting point, not proof of compromise.
- No record: coverage statement only. A fresh or niche indicator may be unknown — absence of evidence is not evidence of safety.
Learn the full reading in How to Interpret IOC Lookup Results.
How to investigate
- Normalise and defang the indicator with the IOC Lookup tool.
- Confirm hash type with Hash Checker when the indicator is a hash.
- Correlate with your own logs — proxy, DNS, mail, endpoints.
- Record the evidence in an investigation and decide with at least two independent signals.
Related concepts
- What is Phishing? — phishing is a major source of fresh IOCs.
- Threat Detection — how indicators fit into detection.
- How to Interpret IOC Lookup Results — reading a match correctly.
- Analyze an Indicator — understand indicator types before lookup.
Next steps
- Always keep provenance: which source, when observed, at what confidence.
- Treat a single hit as a lead; escalate only with correlation.
- Re-check periodically — indicators go stale as infrastructure changes.
References
Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.