Cybersecurity definition
What is IOC?
IOC stands for Indicator of Compromise.
By Cyber Tool Stack Editorial TeamUpdated
Definition
Forensic evidence that a system has already been breached — a malicious file hash, a known-bad IP address, a suspicious registry key — used to detect or confirm past or ongoing compromise.
Where IOC fits in the security landscape
These beginner lessons use this term while explaining the surrounding security control.
Related cybersecurity terms
IOAIndicator of AttackA signal that describes an attacker's intent and behavior in progress — such as a process trying to dump credentials — rather than a static artifact left behind, letting defenses catch an attack while it's still unfolding instead of only after the fact.C2Command and ControlThe infrastructure and channel an attacker uses to remotely control malware already running on a compromised system — issuing commands, exfiltrating data, or pulling down additional tools.YARAA rule-based pattern-matching language and tool used to identify and classify malware by describing textual or binary patterns found in a file, widely used by malware researchers to write and share detection signatures.