TechKnowSurge

VideoSecurityFree

Indicators of Compromise (IoC)

Indicators of compromise (IoCs) and indicators of attack (IoAs) are the signs and signals security professionals use to detect whether a network, host, or application has been targeted or successfully breached. This coverage explains the distinction between the two terms, where to look for these indicators, and how employee reporting factors into an organization's overall detection strategy.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Indicators of compromise and indicators of attack are foundational concepts in security monitoring, representing the observable evidence that helps analysts determine whether a system or network has been targeted or successfully breached. An indicator of attack reflects hostile activity in progress, such as repeated authentication failures or unusual scanning behavior, without confirming that the attacker has actually gained access. An indicator of compromise takes the analysis further, suggesting the attack succeeded and that data may be at risk, systems may be under adversary control, or other damage is already occurring. In practice, many security professionals use the term indicator of compromise as a broad umbrella covering both stages, while others treat the two as distinct concepts that map to different points in the attack timeline. These indicators are evaluated across every layer of an environment. At the network level, analysts look for abnormal bandwidth consumption, unexpected beaconing, irregular peer-to-peer communication, rogue devices, and traffic appearing on unusual ports. At the host level, relevant signals include excessive processor or memory usage, unauthorized software or scheduled tasks, privilege changes, and signs of data exfiltration or abnormal OS process behavior. Application-layer indicators include anomalous account activity, unexpected outbound communication, and service interruptions captured in application logs. Employee behavior represents an additional and often underutilized detection layer. Social engineering attacks, such as impersonation messages appearing to come from executive leadership, may go unreported unless staff are specifically trained to recognize and escalate suspicious contact. When organizations invest in that training, employees become an active part of the detection pipeline, providing early warning signals that complement technical monitoring and allow security teams to alert the broader workforce before an attack gains further traction.

What you'll learn

Distinguish between indicators of attack (IoA) and indicators of compromise (IoC), including how each maps to the stages of a network intrusion
Identify common IoCs across network, host, and application layers, including anomalous traffic patterns, unauthorized system changes, and suspicious process behavior

What's covered

Indicators of Compromise

Key Definitions
- Indicator Explained
- Indicator of Attack (IoA)
- Indicator of Compromise (IoC)
- Attack vs. Compromise
Network-Level IoCs
- Bandwidth Consumption
- Beaconing & P2P Traffic
- Rogue Devices & Scans
- Unexpected Open Ports
Host-Level IoCs
- Resource Consumption
- Unauthorized Software & Processes
- Privilege & Execution Changes
- File & Registry Anomalies
Application-Level IoCs
- New or Anomalous Accounts
- Unexpected Outbound Communication
- Service Interruptions & Logs
Social Engineering Indicators
- Employee Reporting
- Spear Phishing Awareness
- User Training Importance

Key terms

Indicators of Attack: Indicators of Attack are real-time behavioral signals revealing that an attack is actively in progress, such as credential harvesting or lateral movement patterns, complementing IoCs which identify post-compromise artifacts.
Indicators of Compromise: Indicators of Compromise are forensic artifacts such as file hashes, IP addresses, domain names, and registry keys that provide evidence a system may have been compromised, enabling threat detection and intelligence sharing.
Data Exfiltration: The unauthorized transfer of data from a system to an external destination.
Privilege Escalation: An attack that exploits vulnerabilities to gain higher-level access than originally authorized.
Beaconing: A pattern of regular, repeated outbound network communications from a compromised host to an attacker's command-and-control server.
Malware: Software specifically designed to disrupt, damage, or gain unauthorized access to a system.
Social Engineering: A manipulation technique that exploits human psychology to trick individuals into revealing confidential information.
Spear Phishing: A targeted phishing attack directed at a specific individual or organization using personalized information.
Baseline: A documented set of minimum security standards or performance metrics used as a reference point.
Log Management: The process of collecting, storing, analyzing, and monitoring log data generated by systems and applications.

Topics

Indicators Of Compromise Indicators Of Attack Threat Detection Network Intrusion Cybersecurity Security Monitoring

Transcript

What an Indicator Is

As security professionals, we're going to be taking a look at our network and making sure that it's not being attacked, that there's no breaches on it, that there's no compromised systems. What we're going to be looking for are indicators that something is off, that we want to dig further into. We'll set up monitoring for that, and we'll set up alerts for that.

An indicator is something that shows or suggests a state or level of something. An indicator might be like a thermometer: if you have a thermometer outside, there's indicators on it that show us what the temperature is out there, so the indicator is going to show us the exact temp.

An indicator of compromise is just going to show us if there's been some sort of compromise, if there's been some sort of breach on our network. There are signs — whether it be logs that are happening, or alerts, or some sort of data signs — that something has been breached or compromised, and we're looking for those indicators that that's the case.

Attack Versus Compromise

You'll also see a term indicators of attack, and that's just something that suggests that there's been an attack. Not necessarily a breach, just an attempt at something. For instance, if somebody's trying to hack into an account and trying a bunch of usernames and passwords, some of the log files might show us that there's an attack going on, but it doesn't necessarily mean that they've already compromised anything, that they've figured out what the username and password is — just that the attack is being carried out.

So here we have a network, and if somebody's trying to hack into that network, they're attacking the network. They have not necessarily breached the firewall; they've not gotten into the network at this point in time. As soon as they do, now that's called a compromise. There's a breach. Maybe they're stealing data, maybe they're having some sort of other impact — but at this point in time, we are compromised. An attack has to happen first before there's a compromise. I kind of look at it as, there's the attack side of this, and then the compromise is the next step to the attack. And so we have both indicators for an attack and indicators for a compromise.

Why the Two Terms Blur

The thing with it is that we see some of the same exact indicators. The indicators, whether there's an attack that's happening or a compromise that's happening, could be exactly the same. Let's say I'm looking at log files and I'm looking at indicators. If these indicators are just indicating something that's happened, I don't even know yet. Does this indicate that there's an attack? Does it indicate that there's a compromise? I'm not sure. That's why I'm digging into it — I'm digging into these indicators.

Where the confusion comes in is that some sources are going to list out indicators of attacks and indicators of compromises, and they're going to suggest they're two different things, because an indicator of attack is just showing that there's been an attack happening, not necessarily that they've gotten in and broken in and compromised something, but an indicator of compromise takes it to the next step: that the attack was successful and now they've compromised something. So we consider these two terms as two different things.

However, a lot of people out there are just going to use the one term, indicator of compromise. Indicator of compromise is just going to be indicators — it's all of this, whether an attack has happened, a compromise has happened, or nothing has happened yet but it's just an indicator and we need to look into it. That's what an indicator of compromise is. So indicator of compromise can either mean one or the other, versus indicator of attack meaning that you're kind of breaking down the two concepts as being two separate concepts.

A Few Examples

Here are just a few examples of indicators of compromise: things like if your account is getting locked out — maybe that's because somebody's tried enough times to lock your account, and so that can be a problem. Or maybe there's some sort of blocked content, or maybe it's some sort of resource consumption. We're going to take a much deeper look into this.

Where We Look

Where are we going to look at these indicators? We're going to look at the network as a whole, we're going to look at the host, we're going to look at the applications. We're going to look at all levels to see what's happening on our systems, on our networks.

On the network, we're going to look for:

bandwidth consumption
something called beaconing
irregular peer-to-peer communication
rogue devices on our network
scans and sweeps on our networks
any kind of unusual traffic spikes
activity and unexpected ports that are open or communicating on our network

Then there's the host, the actual individual machines that are sitting on our network. We're going to look at:

processor consumption
memory consumption
drive capacity consumption
unauthorized software
malicious processes
unauthorized changes
unauthorized privilege changes
unauthorized executions
data exfiltration
abnormal OS process behavior
file system changes or anomalies
registration changes or anomalies
unauthorized scheduled tasks that show up on the computer

Then there's the application-related IoCs, like:

anomalous activities
introduction of new accounts
unexpected output
unexpected outbound communication
service interruptions
application logs

Employees as an Indicator

I'm going to add actually one more to this, and that is social engineering and employees, because social engineering is a big attack surface that we have and they're going to be leveraging employees. Training those employees to report things is going to be another indicator that something is happening.

If they're reporting some sort of strange behavior — for the most part, your end users are really not going to report a lot of stuff. The majority of them are not going to report a lot of stuff unless you have proper user training. For instance, maybe there's some sort of social engineering attack where they're getting text messages from the CEO, and the CEO wouldn't really normally communicate with them. They might just think this is odd, but I'm going to do what the CEO wants me to do. That's a social engineering tactic that people use out there.

By training them, they not only stop that type of an attack, but they can report that type of attack. And if they report that kind of attack, we can send out to the rest of the company and say, watch out for this — we are finding that there are some spear phishing targets happening where you could get a text message from the CEO, or what appears to be from the CEO. So train them to make sure that they don't fall for that.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →