Indicator of compromise (IOC)

Also written: IOC, IOCs, indicator

A clue, such as a bad address, domain or file hash, that shows an attacker may have been active. In STIX it is an indicator object with a pattern, and olevba also lists IOCs it finds in macros.