An indicator of compromise (IOC) is a technical artifact or observable that suggests an attack is imminent, in progress, or has already led to a compromise. IOCs are the shareable, machine-readable part of threat intelligence.

Common types

• File hashes of known malicious programs.
• IP addresses and domains used for command and control or phishing.
• URLs, email sender addresses and subject lines from known campaigns.
• Host artifacts such as registry keys, file paths, mutex names or scheduled tasks.

Security teams load IOCs into firewalls, EDR tools and SIEM platforms to block activity or to search logs for past matches. Many IOCs have a short life: attackers change servers and recompile malware, so a hash or IP address can go stale quickly. Behavior-based detection built on TTPs tends to last longer than a single indicator.

Why it matters for dark web monitoring

Underground sources often surface indicators before they appear in public feeds: infrastructure advertised for rent, malware builds offered for sale, or stealer log files that name the domains and machines involved. Turning such findings into IOCs lets defenders check their own logs for related activity. Each indicator still needs context, such as where it was seen, how old it is and how reliable the source is, before it is used to block traffic.

Sources: NIST CSRC Glossary: indicators of compromise, NIST CSRC Glossary: indicator