Glossary: Application and Credential Attacks, and AI Risks

indicator of compromise (IoC)

Also written: IoC, IoCs, indicators of compromise

A piece of evidence that an attacker has been, or still is, inside a system, such as a known malicious hash, an unusual process or a suspicious sign-in pattern. Analysts use IoCs to spot attacks and search other systems for the same intrusion. Examples include plaintext strings, account lockouts, impossible travel and concurrent sessions.