Even organizations with solid security still get hit. Indicators of compromise (IoCs) are the leftover clues — log entries, alerts, and odd system changes — that something malicious already happened or is still in progress. Taking those clues seriously is how you find the source, contain it, and keep the same attack from succeeding twice.
Related: What is application security.
What they are
An indicator of compromise is any piece of evidence that points to malicious activity on a system or network. Analysts often have to stitch together unfamiliar log lines, registry changes, and traffic patterns. The point is not trivia — it is to identify, isolate, and stop further damage.
Common indicators
Unusual outbound activity
Unauthorized traffic leaving the network is one of the most useful signs. Teams often watch inbound threats more closely than outbound. If an attacker is already inside, outbound traffic may be the last chance to stop data from leaving.
Irregular geographic patterns
If the company works from a small set of offices or regions, logins or traffic from a country nobody works in should be flagged.
Login anomalies
Repeated failed logins on the same account usually mean someone is iterating through credentials. Stop the account and investigate before it succeeds.
Suspicious registry changes
Malware often persists by changing Windows registry keys. Keep a known-good baseline so those changes stand out.
Unauthorized privilege changes
If accounts that were read-only suddenly have write access, treat that as an IoC and review admin activity immediately. Related: security risk analysis.
How to use them
Attacks tend to follow patterns. Document what you see in a consistent format, automate collection where you can, and feed that into incident response. Related: cloud computing security.
If you want help building monitoring and response around IoCs, contact Cyber Security Resource.