IOCs: The Digital Fingerprints Attackers Leave Behind

The 30-second explanation

Like fingerprints or footprints at a crime scene, IOCs are the small traces attackers leave, which defenders can search for across their own systems.

How it works

1. 1

   1. Investigate

   Analysts examine an incident.

2. 2

   2. Extract

   Hashes, domains and addresses are noted.

3. 3

   3. Share

   Indicators are passed to other defenders.

4. 4

   4. Search

   Logs are checked for the same traces.

When an incident is investigated, analysts extract the traces the attacker left: the fingerprint of a malicious file, the servers it contacted, the domain used in a phishing email. Those indicators are shared so other defenders can search their own logs for the same items. Because attackers can change these easily, IOCs are a fast, useful starting point but a weak long-term defence, which is why behaviour-based detection matters too.

Real-world example

How to spot it

• Expired indicators

  Old IOCs may no longer belong to the attacker.

• Shared infrastructure

  An address used by many innocent sites can cause false alarms.

• One-off matches

  A single hit needs context before acting.

• No source

  An indicator with no explanation of where it came from.

What to do

1. 1Check the age and source of an indicator before you block anything based on it.
2. 2Search historical logs as well as new ones: a match from last week still matters.
3. 3Pair IOCs with behavioural detections, since attackers change indicators easily.