Explain like I'm five · Security
What is an IOC?
Indicators of Compromise, told as a story about footprints.
Someone was here.They left footprints.
Clues come in a few shapes.Where they came from, and what they left behind.
A strange addressan IP address
A strange sendera domain or URL
A fingerprint on a thinga file hash
You share the footprint with friends.What one castle saw, every castle can look for.
But new shoes make a new footprint.So footprints alone aren't enough. You need their habits (TTPs) too.
In one breath
IOC = a trace the bad guy left. If you see it, they were already here.
An indicator doesn't stop the break-in; it helps you spot one that happened. Shoes are cheap to change, so indicators go stale fast.
When grown-ups say it
- File hash
- A thing's fingerprint. A long number unique to one file. Change one byte and the fingerprint changes.
- IP address
- A house address. Where the bad guy's computer lives.
- Domain
- A house name. A name used instead of the address. Buying a new one takes hours.
- Threat feed
- A stack of footprint photos. Traces other castles saw, arriving all day.
- False positive
- Our own dog's paw print. Looked like the burglar's, wasn't.
Next story
The Burglar's Habit →