Types of Indicators of Compromise (IOCs)
The common categories of indicators of compromise — network, host, file and account signals — and how security teams use them for detection and hunt.
Quick Answer
IOCs come in four families — network (IP/domain/URL), host (paths/regkeys/services), file (hashes/names), account (+behavioral) — and are strongest when combined; never treat a single low-fidelity IOC as definitive.
Definition
An Indicator of Compromise is an observable that signals a past or ongoing intrusion; IOCs span network, host, file and account domains and vary widely in fidelity.
What it is
IOCs are observables that indicate compromise. Classifying them by domain makes detection and validation practical instead of a giant blob of indicators.
Why it matters
Not all IOCs are equal: a file hash is high-fidelity but unique to one artifact; a shared IP is low-fidelity and heavily reused by legitimate traffic. Understanding the families and their fidelity prevents both false alarms and missed signs.
How it works — the four families
- Network: IPs, domains, URLs, C2 endpoints — high-volume, often low-fidelity (see
security:what-is-an-ioc). - Host: file paths, registry keys, service names, scheduled tasks — moderate/high fidelity.
- File: SHA-256 hashes, filenames, file sizes, PE/AV metadata — high fidelity, narrow scope.
- Account: usernames/emails + behavioral signals (impossible travel, privilege spikes) — high value when enriched.
Detection
- Cross-match artifacts against Threat Intelligence IOC sets (see
guides:tool-ioc-guide). - Treat IOCs as hunt inputs, not automatic verdicts: combine a file hash with a network pivot for confidence.
Mitigation
- Ingest and deduplicate IOCs; timestamp and source every indicator.
- Weight IOCs by fidelity; automate low-fidelity-in-primary, escalate on correlation.
Investigation
Pivot across families: hash → parent process/host → C2 IP → other hosts → TTPs. See guides:suspicious-domain-investigation and guides:analyze-ioc.
References
Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.