What is indicator of compromise (IOC) in cyber security

What is indicator of compromise (IOC) in cyber security ? Its are “pieces of forensic data, such as data found in system log entries or files, that identify potentially malicious activity on a system or network.” Indicators of compromise aid information security and IT professionals in detecting data breaches, malware infections, or other threat activity. By monitoring for indicators of compromise (IOCs), organizations can detect attacks and act quickly to prevent breaches from occurring or limit damages by stopping attacks in earlier stages.

Indicators of compromise (IOCs) act as breadcrumbs that lead infosec and IT pros to detect malicious activity early in the attack sequence. These unusual activities are the red flags that indicate a potential or in-progress attack that could lead to a data breach or systems compromise. But, IOCs are not always easy to detect; they can be as simple as metadata elements or incredibly complex malicious code and content samples. Analysts often identify various IOCs to look for correlation and piece them together to analyze a potential threat or incident.

Indicators of Compromise (IOCs) serve as forensic evidence of potential intrusions on a host system or network. These artifacts enable information security (InfoSec) professionals and system administrators to detect intrusion attempts or other malicious activities. Security researchers use IoCs to better analyze a particular malware’s techniques and behaviors. IOCs also provides actionable threat intelligence that can be shared within the community to further improve an organization’s incident response and remediation strategies.

Some of these artifacts are found on event logs and timestamped entries in the system, as well as on its applications and services. InfoSec professionals and IT/system administrators also employ various tools that monitor IoCs to help mitigate, if not prevent, breaches or attacks.

Here are some indicators of compromise information security professionals and system administrators watch out for:

• Unusual traffic going in and out of the network
• Unknown files, applications, and processes in the system
• Suspicious activity in administrator or privileged accounts
• Irregular activities such as traffic in countries an organization doesn’t do business with
• Dubious log-ins, access, and other network activities that indicate probing or brute force attacks
• Anomalous spikes of requests and read volume in company files
• Network traffic that traverses in unusually used ports
• Tampered file, Domain Name Servers (DNS) and registry configurations as well as changes in system settings, including those in mobile devices
• Large amounts of compressed files and data unexplainably found in locations where they shouldn’t be

Feel free to contact E-Spin to secure your organization from activity malicious on a system or network. We have many technologies and solution to protect your organization.