Indicator of compromise

Indicator of compromise (IOC) — in computer forensics is an artifact observed on a network or in an operating system that with high confidence indicates a computer intrusion.[1]

Typical IOCs are virus signatures and IP addresses, MD5 hashes of malware files or URLs or domain names of botnet command and control servers. After IOCs have been identified in a process of incident response and computer forensics, they can be used for early detection of future attack attempts using intrusion detection systems and antivirus software.

For more efficient automated processing there are initiatives to standardize format of IOCs.[2][3] Known indicators are usually exchanged within the industry.[4]

References

  1. ↑ "Understanding Indicators of Compromise (IOC) Part I". RSA. 2012. Retrieved February 27, 2013.
  2. ↑ "The Incident Object Description Exchange Format". RFC 5070. IETF. 2007. Retrieved February 27, 2013.
  3. ↑ "Cyber Observable eXpression (CybOX)". Mitre. Retrieved February 27, 2013.
  4. ↑ "IOC Bucket".
This article is issued from Wikipedia - version of the Monday, June 08, 2015. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.