Hack the Route Start free Open app Detection and response
Indicators of compromise (IOC)
Concrete artifacts of an attack — an address, a file path, a hash — that you block and hunt for everywhere.
An indicator of compromise is a reusable fact drawn from one incident: the command-and-control address a host beaconed to, the path of a dropped implant, a domain, a file hash. Its value is reuse — you block the address network-wide, sinkhole the domain, and search every other host's logs for the same artifacts, turning a single case into detection across the whole estate.