Indicator of compromise

An indicator of compromise (IoC) in computer forensics is an artifact observed on a computer network or within an operating system that, with high confidence, indicates a computer intrusion. ^[1]

Types of indicators

Common IoCs include virus signatures, suspicious IP addresses, MD5 hashes of malware files, and malicious URLs or domain names associated with botnet command and control servers. Once IoCs are identified through incident response or forensic analysis, they can be used for early detection of future attacks with intrusion detection systems and antivirus software.

Automation and sharing

Several standards and initiatives aim to automate IoC processing and sharing:

• The Incident Object Description Exchange Format (IODEF) standardizes how incident information is described and exchanged. ^[2]
• Structured Threat Information Expression (STIX) is used to represent cyber threat information. ^[3]

Known indicators are often exchanged within the cybersecurity industry, commonly using the Traffic Light Protocol (TLP) to indicate how information may be shared. ^[4] Other frameworks and standards are also used to support secure information sharing. ^{[5] [6] [7] [8] [9] [10]}

See also

• AlienVault
• Mandiant
• Malware
• Malware Information Sharing Platform

References

1. Gragido, Will (3 October 2012). "Understanding Indicators of Compromise (IoC) Part I". RSA. Archived from the original on 14 September 2017. Retrieved 5 June 2019.
2. "The Incident Object Description Exchange Format". IETF. December 2007. Retrieved 5 June 2019.
3. "Introduction to STIX". OASIS. Retrieved 5 June 2019.
4. "FIRST announces Traffic Light Protocol (TLP) version 1.0". Forum of Incident Response and Security Teams. Retrieved 31 December 2019.
5. Luiijf, Eric; Kernkamp, Allard (March 2015). "Sharing Cyber Security Information" (PDF). Toegepast Natuurwetenschappelijk Onderzoek. Retrieved 31 December 2019.
6. Stikvoort, Don (11 November 2009). "ISTLP – Information Sharing Traffic Light Protocol" (PDF). National Infrastructure Security Co-ordination Centre. Archived from the original (PDF) on 25 October 2016. Retrieved 31 December 2019.
7. "Development of Policies for Protection of Critical Information Infrastructures" (PDF). Organisation for Economic Co-operation and Development. Retrieved 31 December 2019.
8. "ISO/IEC 27010:2015". International Organization for Standardization / International Electrotechnical Commission. November 2015. Retrieved 31 December 2019.
9. "Traffic Light Protocol (TLP) Definitions and Usage". United States Department of Homeland Security. Retrieved 31 December 2019.
10. "Traffic Light Protocol". Centre for Critical Infrastructure Protection. Archived from the original on 5 February 2013. Retrieved 31 December 2019.