IOC Indicator of Compromise
A specific artifact (file hash, IP, domain, registry key) that signals the presence of a known threat. IOCs are useful but reactive; Vijilan SOC complements them with behavioral detection.
Common indicators are file hashes, IP addresses, domain names, URLs, registry keys, mutex names and certificate fingerprints. Each is a fact about something that has already happened: this file was seen, this address was contacted. That is what makes indicators easy to share between organizations and trivial to match at scale, and it is also what makes them backward-looking.
Indicators expire. A hash is invalidated by a single recompile, and infrastructure is now routinely rotated faster than feeds can distribute it. A detection programme built only on indicator feeds is therefore always describing the last intrusion rather than the current one, and it fails completely against an adversary who has never been catalogued.
They still earn their place, because when an indicator matches it is unambiguous and instant, with essentially no analyst time spent deciding whether it is real. The working pattern is to use indicators for cheap high-confidence hits and behavioral detection for everything they cannot see. Vijilan’s SOC runs both, and treats an indicator match as the start of an investigation rather than the end of one.
Common questions
What is an indicator of compromise?
An indicator of compromise is an observable artifact that shows a known threat was present in an environment. Typical examples are a malicious file hash, an attacker-controlled IP address or domain, a registry key created by malware, or a distinctive certificate. Indicators are matched against telemetry to spot intrusions that have already been documented somewhere.
What is the difference between an IOC and an IOA?
An indicator of compromise says a known-bad thing was observed. An indicator of attack describes behavior consistent with an intrusion in progress, such as credential dumping or unusual process injection, whether or not any known-bad artifact appears. Indicators of compromise tend to confirm a breach after the fact, while indicators of attack aim to catch it while it is still developing.
Why do indicators of compromise expire so fast?
Because they identify artifacts rather than behavior, and artifacts are cheap for an attacker to replace. Recompiling a payload produces a new hash. Rotating to fresh infrastructure produces new addresses and domains. By the time an indicator has been observed, analyzed, published and ingested, the adversary has often already moved past it.
IOC is one signal.
We watch the rest.
Vijilan runs a 24/7 SOC across endpoint, identity, cloud, network, SaaS and mobile, and acts on what it finds rather than forwarding an alert.