Indicators of Compromise (IoCs): Early Signs of Cyber Attacks

1. Network Indicators

Network-based IoCs are derived from traffic patterns and communication behaviors across the network. These indicators often reveal command-and-control (C2) communication, malware delivery attempts, or data exfiltration activities.

Unusual outbound traffic to unfamiliar IP addresses or abnormal DNS requests can indicate that a compromised system is communicating with an attacker-controlled infrastructure.

Examples of network IoCs

• Suspicious domain name queries
• Connections to known malicious IP addresses
• Abnormal spikes in outbound traffic
• Suspicious URLs used for malware delivery
• Irregular protocol usage or encrypted traffic anomalies

Operational value: Network IoCs are especially useful for identifying lateral movement and detecting compromised systems attempting to communicate externally.

2. Host-Based Indicators

Host-based IoCs are artifacts discovered directly on endpoints or servers during forensic analysis. They provide evidence of malicious activity at the system level and are often critical for understanding persistence mechanisms.

These indicators can include altered files, registry modifications, or suspicious processes running in memory.

Examples of host-based IoCs

• Malicious file names and hashes
• Registry key changes associated with persistence
• Suspicious DLL injections or mutex objects
• Unauthorized system configuration changes
• Presence of unknown scheduled tasks or startup items

Operational value: Host-based indicators help analysts confirm compromise, track attacker persistence, and support forensic investigations.

3. Email Indicators

Email remains one of the most common initial attack vectors due to its accessibility and effectiveness in social engineering campaigns. Email IoCs help detect phishing attempts, malware delivery, and credential harvesting attacks.

Attackers often disguise malicious content within legitimate-looking messages to trick users into executing payloads or revealing sensitive information.

Examples of email IoCs

• Suspicious sender addresses or spoofed domains
• Malicious attachments or embedded links
• Deceptive subject lines triggering urgency
• Mismatched URLs within email content
• Unexpected email-based credential requests

Operational value: Email IoCs enable security teams to identify phishing campaigns early and block malicious communications before users are impacted.

4. Behavioral Indicators

Behavioral IoCs focus on abnormal activities exhibited by users, applications, or systems. Instead of static artifacts, these indicators highlight suspicious patterns that deviate from normal operational behavior.

Behavioral analysis is increasingly important in detecting advanced threats that evade signature-based detection.

Examples of behavioral IoCs

• Office documents launching PowerShell scripts
• Unauthorized remote command execution
• Privilege escalation attempts
• Unusual user login patterns or session anomalies
• Processes executing outside their typical context

Operational value: Behavioral indicators are highly effective in detecting advanced persistent threats (APTs), insider threats, and fileless malware attacks.