Imagine this: A threat actor quietly infiltrates an organization’s network by exploiting a known vulnerability. At first, the activity might appear subtle or go unnoticed by security teams – unusual network behavior, odd commands being run in the background, or credentials being utilized in places they shouldn’t be – because individually each isn’t always a sign of malicious activity. However, over time, the picture becomes clearer, with added details, such as a suspicious login from an IP address overseas.
These kinds of digital artifacts are known as indicators of compromise (IOCs). They’re the signs security teams rely on to recognize when something isn’t right in the IT environment or network, and the clues that suggest a system has been breached or that an attack may be underway or has already happened.
What Are Indicators of Compromise?
An indicator of compromise (IOC) is any piece of data that indicates a cyber attack is occurring or has occurred. IOCs can take many forms, such as a malicious file on a system, an unusual IP address connecting to a network, a suspicious user login, or a domain name tied to malicious activity.
Threat intelligence researchers analyze IOCs to track attacker techniques and emerging trends, digital forensics teams use them to trace the root cause of breaches, and security solutions like managed detection and response (MDR) and endpoint detection and response (EDR) apply rule sets and behavioral analysis to identify IOCs early, helping mitigate threats before they escalate.
IOCs often fall into five categories: network indicators, behavioral indicators, host indicators, email indicators, and data exfiltration indicators.
- Network indicators include data or activity that has occurred on the network, and can include abnormal traffic, unusual port or protocol usage, sudden user behavior changes, or access from malicious IPs.
- Behavioral indicators are connected to an individual user account and come in the form of unusual behavior such as incorrect logins, unauthorized file access, unusual login times, login attempts originating from outside geographic boundaries, and more.
- Host / endpoint indicators show evidence of compromise on an endpoint, server, or device, and can include file signatures, registry keys, network data, and other system-based data that can indicate to security teams that something is amiss.
- Email indicators are connected to emails received within an email account and can include malicious details such as unknown senders, corrupted or malware-laden attachments, links to known malicious domains, and more.
- Data exfiltration indicators point to attempts by threat actors to steal sensitive data from an environment, often preceding extortion or ransom demands during ransomware events. They can include abnormal patterns of data movement, particularly outbound traffic that deviates from normal business activity.
The example described at the start of this post was not a hypothetical scenario, but a real incident observed by Arctic Wolf, where enumeration commands executed by the threat actors were consistent with IOCs aligned with Ryuk ransomware. In that specific case, the IOC was discovered due to previous threat intelligence gathering by Arctic Wolf that was then applied to the suspicious activity happening within the network, allowing the organization’s (and Arctic Wolf’s) security teams to see, in near-real time, that an incident was occurring.
As in that example, IOCs are often used to help contextualize otherwise independent pieces of data. They each may not be indicative of a cyber attack, but when pieced together, they paint a clear picture of what’s occurring within an organization’s environment while providing security teams with vital data needed to take appropriate actions.
Common Examples of IOCs
IOCs can arrive in various forms but often carry distinctive signatures — like the replicating behavior seen by a known ransomware strain — that allow detection and response tools, when manned and monitored by cybersecurity professionals, to identify and act on them.
Indicators of compromise examples, by category, include:
Network IOCs
- Anomalous traffic patterns: Inbound, outbound, or east-west traffic that deviates from baseline network behavior.
- Geographic irregularities: Logins or connections from unexpected regions, such as a user account accessed from a foreign country without authorization.
- Unusual port or protocol usage: Traffic on non-standard ports or uncommon protocols used in suspicious contexts.
- Command-and-control (C2) communication: Outbound traffic to known malicious or previously unknown domains, IPs, or URLs, or beaconing patterns that suggest contact with attacker infrastructure.
- DNS anomalies: Suspicious or high-volume DNS requests, including those to algorithmically generated domains or signs of DNS tunneling.
Host / Endpoint IOCs
- Unusual application activity: Unauthorized or unknown applications appearing or running on endpoints or servers.
- Application installation or execution: Deployment of unapproved software, often tied to malware or persistence mechanisms.
- Unauthorized configuration changes: Alterations to system or application settings outside normal processes.
- Suspicious file modification or movement: Unexpected compression, relocation, or exfiltration of files (e.g., large amounts of sensitive data suddenly being archived or transferred).
- Unauthorized system changes: Tampering with file signatures, registries, or security configurations.
- Malware artifacts: Presence of files with known malicious hashes, rogue scripts, or persistence artifacts like unauthorized services or scheduled tasks.
User / Account IOCs
- Privileged account anomalies: Uncharacteristic behavior from administrator or privileged accounts, such as sudden permission changes, unexpected file transfers, or configuration edits.
- Repeated failed login attempts: Patterns resembling brute-force activity or login attempts occurring at unusual times.
- User account anomalies: Irregular account usage, such as accessing unfamiliar resources, logging in after hours, or attempting privilege escalation.
Data Exfiltration IOCs
- Excessive outbound data transfers: Unusual spikes in outbound traffic volume.
- Suspicious file preparation for exfiltration: Use of compression or archiving tools immediately before large outbound transfers.
- User account anomalies: Irregular account usage, such as logins after hours, access to unfamiliar resources, or attempts to escalate privileges.
Indicators of Compromise vs. Indicators of Attack
While IOCs offer value, they are not the only evidence organizations use to respond to an attack, and security teams often need more data than just one or multiple IOCs to properly detect and respond to an intrusion. One piece of data used in detection and response strategies is an indicator of attack (IOA).
IOAs focus on detecting real-time attacker behavior. Instead of waiting for evidence of a compromise, IOAs flag anomalous activity that suggests an attack is starting, giving security teams an opportunity to intervene before it escalates.
From a detection perspective, IOAs often serve as a warning sign of malicious activity — an attacker probing for weaknesses, attempting privilege escalation, or moving laterally. If left unchecked, these behaviors may evolve into IOCs once the compromise is successful and a breach has occurred.
Where IOCs are tied to static evidence of known threats, IOAs emphasize attacker intent by surfacing tactics, techniques, and procedures (TTPs) that reveal dynamic, behavior-based patterns. Unlike a file hash or an IP address, these patterns point to how an attacker is operating rather than to a specific artifact. In modern detection and response solutions — particularly those enhanced by AI — analyzing, contextualizing, and categorizing IOAs is critical for generating accurate alerts and enabling faster, more effective response.
Together, IOAs and IOCs provide critical context for detection and response. IOAs enable proactive defense by surfacing initial signs of attacker behavior, while IOCs deliver concrete evidence for investigation, response, and digital forensics during IR investigations.
Role of IOCs in Threat Intelligence
IOCs play a central role in threat intelligence by transforming raw technical evidence into actionable insights. When applied effectively, they help security teams detect malicious activity, understand attacker behavior, and strengthen defenses across the enterprise.
IOCs are utilized within the context of threat intelligence to:
1. Detect and identify known threats or threat activity within an environment
2. Attribute activity to specific threat actors and build and/or improve threat actor profiles
3. Enhance incident response and digital forensics, particularly regarding root point of compromise, incident scope, affected systems, and potential data exfiltration
4. Threat-hunt and defend systems and networks proactively
5. Share vital data and threat intelligence with the larger cybersecurity community
6. Enrich detection and response solutions and refine detection rules in solutions such as MDR and EDR.
Learn how Arctic Wolf Threat Intelligence delivers only the most important information organizations need to remain connected to the threat landscape.
The Limits of IOCs in Security Operations
IOCs continue to evolve and change, as they are directly related to the constantly evolving nature of threats: malware strains appear and morph, the expanding attack surface reveals new targets for exploit, and threat actors continue to shift their signatures in attempts to avoid detection. This dynamic nature does not mean IOCs are not vital for threat detection and incident response, but it highlights how one piece of data is not enough.
Instead, robust threat detection and response requires the right people, processes, and technology, all working in tandem.
While IOCs provide critical evidence after an incident has occurred, they are inherently reactive — pointing to threats that have already manifested. This makes them less effective at detecting novel or highly targeted attacks where no known indicators exist. Another limitation is context. An IOC such as an unusual login or a suspicious IP address may generate alerts, but without behavioral analysis or correlation with other data points, it is difficult to determine whether the activity is truly malicious or a false positive. Additionally, threat actors are evolving to evade security tools. From utilizing living off the land (LotL) techniques and deploying fileless malware to encrypting their traffic, threat actors work hard to conceal their actions, delay response time, and complete their attacks, fast.
These reasons highlight why stopping modern cyber attacks requires more than IOCs alone. A better strategy is for organizations to invest in a security operations approach, where people and processes are paired with cutting-edge technology (such as advanced EDR and MDR solutions), and where IOCs are combined with other valuable real-time data, such as IOAs, behavioral analytics, and contextual threat intelligence, to provide accurate, actionable information and guide response actions.
Explore how Arctic Wolf utilizes IOCs and other data to detect threats, identify key trends, and better protect organizations around the world with the 2025 Security Operations Report.
See how AI-powered endpoint security can enhance your detection and response capabilities beyond traditional IOCs with our on-demand webinar.
