IoC

Forensic artifacts, such as hashes or IPs, that signal a breach.

Indicators of compromise are forensic artifacts such as file hashes, malicious IP addresses or domains, registry keys, or unusual outbound traffic that suggest a system has been breached. Analysts use them for detection, threat hunting, and sharing intelligence through feeds and formats like STIX and TAXII. They matter for identifying and scoping incidents. The exam contrast is an indicator of attack, which focuses on adversary behavior and intent in progress, while an IoC is typically evidence observed after malicious activity has occurred.