What is Indicators of Compromise (IOC)?
Indicators of Compromise: Forensic digital artifacts that serve as technical evidence that a computer network or system has been breached or infected.
Detailed Explanation
Indicators of Compromise (IOCs) are measurable forensic clues left behind by cyber attackers. These include malicious file hashes (SHA-256), suspicious IP addresses, C2 domain names, registry keys, mutexes, and URI strings. Security teams ingest IOCs into detection systems to quickly identify active infections across fleets.
Why IOC Matters for Enterprise Security
- Enables rapid, automated endpoint scanning during active DFIR containment.
- Facilitates threat intelligence exchange across the global cybersecurity community.
- Serves as baseline criteria for configuring firewalls, EDRs, and SIEM correlation rules.
Core Components & Architecture
Atomic IOCs
Static indicators like IP addresses and domain names that cannot be broken down further.
Computed IOCs
Cryptographic file hashes and certificate fingerprints derived from forensic artifacts.
Behavioral IOCs
Dynamic execution patterns and unusual process spawn chains.
The VayuX Systems Approach
VayuX automatically extracts high-fidelity IOCs during DFIR investigations and immediately converts them into autonomous detection heuristics across our Managed SOC clients.