What are indicators of compromise, and what are some common examples a SOC analyst would encounter during daily monitoring?

Question

Accepted Answer

Indicators of compromise, commonly referred to as IOCs, are pieces of forensic evidence that suggest a system or network may have been breached or is currently under attack. They serve as digital breadcrumbs that security analysts use to detect malicious activity, investigate incidents, and prevent future attacks. For a SOC L1 analyst, recognizing IOCs quickly is one of the most critical skills because early detection often determines whether a security event becomes a full-blown incident.

IOCs come in many forms, and understanding the most common types helps you know what to look for during triage. IP addresses are one of the most frequently encountered IOCs. When a known malicious IP address appears in your firewall or proxy logs, it could indicate that a system in your network is communicating with an attacker-controlled server. Domain names work similarly. Attackers often register domains that look like legitimate websites to trick users or to serve as command and control infrastructure.

File hashes are another essential IOC type. Every file has a unique hash value, like a fingerprint. When threat intelligence sources publish the hash of a known malware sample, you can search your environment to see if that exact file exists on any endpoint. Email addresses and email subject lines associated with phishing campaigns are also valuable IOCs, especially when a new campaign is targeting your industry.

Other common IOCs include unusual registry key modifications on Windows systems, suspicious file paths where malware commonly hides, and URLs embedded in phishing emails that lead to credential-harvesting pages. You might also encounter IOCs in the form of specific user-agent strings, unusual patterns of DNS queries, or unexpected outbound network traffic on uncommon ports.

In practice, SOC analysts work with IOCs by importing them into security tools like SIEM platforms, endpoint detection systems, and firewalls. When a match is found, the tool generates an alert that the analyst then triages. It is important to remember that a single IOC match does not always confirm a compromise. Context matters. You need to consider whether the activity is expected, whether multiple IOCs correlate to the same event, and whether the source of the intelligence is reliable. Building the habit of investigating IOCs thoroughly rather than dismissing or blindly escalating them is what separates an effective L1 analyst from an average one.