Definition
Indicators of Compromise (IoCs) are pieces of forensic data that identify potentially malicious activity on a network or system. They serve as digital breadcrumbs left behind by attackers, signaling that a security breach may have occurred or is in progress. Security professionals use IoCs to detect, investigate, and respond to cyber threats by correlating suspicious events with known malicious patterns. For instance, a unique IP address associated with malware command and control servers can be an IoC. While IoCs pinpoint past or present intrusions, threat intelligence provides broader context about attacker tactics, techniques, and procedures. Understanding IoCs is crucial for roles covered by CompTIA Security+, CySA+, and CISSP certifications.