TechKnowSurge
CompTIA CySA+ 1.2 CompTIA CySA+ 1.4 CompTIA Security+ 2.4 ISC2 CISSP 7.7 CompTIA Security+ 4.4 NIST CSF DE.CM-03 NIST 800-53 SI-4
TechKnowSurge Catalog Videos Indicators of Compromise (IoC)
VideoSecurityFree

Indicators of Compromise (IoC)

Indicators of compromise (IOCs) are the signs detected through network monitoring that suggest a system or account has been attacked or breached. Recognizing common IOCs—such as account lockouts, impossible travel, and missing logs—is a foundational skill in network security monitoring.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Indicators of compromise (IOCs) are signs detected through network logging and monitoring that suggest a system has been breached or is under attack. Security teams collect data from a wide range of sources across the network and analyze that data for patterns or anomalies pointing to unauthorized access or malicious activity. A technically distinct but related concept, indicators of attack (IOAs), refers to evidence that an attack is in progress without confirmation of a successful compromise—for example, repeated failed login attempts suggest an ongoing brute-force effort but do not yet confirm that access has been gained. In practice, both types of indicators are commonly grouped under the IOC label. Several specific signals serve as reliable IOCs in operational environments. Account lockouts triggered by excessive failed login attempts, multiple simultaneous sessions under the same user credentials, and impossible travel—where a single account logs in from geographically distant locations within an implausibly short time—all suggest credential theft or unauthorized access. Unexpected content blocking may indicate malware has taken hold on a device, while sudden service unavailability can point to a denial-of-service attack in progress. Abnormal spikes or drops in resource consumption such as CPU usage, and out-of-cycle logging patterns that deviate from established baselines, also warrant investigation. Perhaps most critically, missing or deleted log entries are a strong signal that an attacker has gained access and is actively working to erase evidence of their presence.

What you'll learn

What's covered

Indicators of Compromise (IOC)

Aligned to

CompTIA CySA+
1.2 Given a scenario, analyze indicators of potentially malicious activity.
1.4 Compare and contrast threat-intelligence and threat-hunting concepts.
CompTIA Security+
2.4 Given a scenario, analyze indicators of malicious activity.
4.4 Explain security alerting and monitoring concepts and tools.
ISC2 CISSP
7.7 Operate and maintain detection and preventative measures.
NIST CSF
DE.CM-03 Personnel activity and technology usage are monitored to find potentially adverse events.
NIST 800-53
SI-4 System Monitoring

Key terms

Indicators of Compromise
IoC
Indicators of Compromise are forensic artifacts such as file hashes, IP addresses, domain names, and registry keys that provide evidence a system may have been compromised, enabling threat detection and intelligence sharing.
Indicators of Attack
IoA
Indicators of Attack are real-time behavioral signals revealing that an attack is actively in progress, such as credential harvesting or lateral movement patterns, complementing IoCs which identify post-compromise artifacts.
Brute Force Attack
An attack method that systematically tries all possible combinations of passwords or keys until the correct one is found.
Impossible Travel
A security alert triggered when account logins occur from geographically distant locations within a timeframe that makes physical travel impossible, indicating potential unauthorized access.
Concurrent Logins
Multiple simultaneous sessions under the same user account, which may indicate unauthorized access or account sharing by a threat actor.
Log Management
The process of collecting, storing, analyzing, and monitoring log data generated by systems and applications.
Denial of Service
DoS
An attack that floods a system or network with traffic to make it unavailable to legitimate users.

Topics

Indicators Of Compromise Indicators Of Attack Network Security Monitoring Threat Detection Cybersecurity Intrusion Detection

Transcript

One of the reasons why we monitor our network is to figure out when we've been compromised, to detect when something in our network has been compromised. So what we're going to look for when it comes to monitoring is indicators that there has been a compromise.

What an Indicator Is

An indicator is a sign, so when we say indicator of compromise we're looking for signs that something has been compromised. What we want to look at in our network is all of our logs, all of our monitoring, and we want to look for indicators that would suggest that we might be compromised, that there's an attacker within our system and our system might be compromised.

Indicators of Attack

There is a similar term, indicators of attack. Indicators of attack are going to be signs that there could be an attack that's happening, but not necessarily a compromise. Let me give you an example of this. Maybe we have a machine and somebody's trying to log into this machine and they're trying lots of usernames and passwords. What that is is an indicator that maybe they're trying to attack that system, but it's not a sign until they're successful. It's not a sign that anything has been compromised yet, just that there's an attack underway.

Now this term attack versus compromise: attack is kind of what happens first, that somebody's attacking, and at some point in time if they find a way to compromise the system, now it's a compromise. Really, when it comes to us looking for signs, we're going to look for both indicators of attack and indicators of compromise, and generally speaking we just call them both indicators of compromise. So while there is a technical difference between these two, generally speaking we just call it an indicator of compromise.

How We Find Them

So how do we find these indicators of compromise? It's going to be that any of the methods that we use for monitoring could identify that there's been a compromise or an attack on our network, and we're going to be logging from all sorts of sources to see if there is any compromise anywhere on our network.

Some Indicators of Compromise

Here are some different indicators of compromise. This is not an exhaustive list, this is just a few of the indicators out there.

  • One of them is if there are accounts that are getting locked out. If somebody's trying usernames and passwords, they could hit some sort of threshold and get locked out of a system, so it's a sign that somebody might be trying to do a brute force attack and try to guess a username and password.
  • Also if there's concurrent session logins. For instance, let's say you had a system and two people, the same user, logged in twice. Now why are they logged in twice to the same system? Maybe that's somebody else, maybe it's an attacker that did some sort of piggyback and logged into the server at the same time, or system at the same time, and so that could be problematic.
  • This used to be more common, where you had web browsers that would be taken over and then it would block certain content. So if there's certain content that's being blocked, perhaps there's some sort of malware on the system or other type of compromise.
  • There's also this idea of impossible travel. If somebody logged in in the United States and then 10 minutes later logged in from Asia, there's not really a possibility that somebody was actually in the United States logged in and then flew over to Asia and logged in over there in 10 minutes. So that's an impossible travel, and that would be an indicator that there are two different people using that same account.
  • There's also resource inaccessibility. That is that sometimes services go down, and that might be because somebody's doing something like a denial of service attack, so it's a sign that there's an attack or a compromise that's happening.
  • There's out of cycle logging. We're going to want to look to see what the trend lines are and the usual trends seen during certain times, and if we see something that's extremely low or extremely high we can identify that this could be a possible problem. That includes resource consumption, so if we see like CPU usage that's going way up, way crazy high, or it was really low for that time, then maybe that's a concern.
  • And then also if there's missing logs. One of the things that attackers will do to cover their tracks is they'll go in and start deleting logs.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →