What Indicators of Compromise Are and How Organizations Use Them

Summary

An introductory explainer defines IoCs, distinguishes them from IoAs, and describes how organizations use and share threat indicators. It also highlights DarkOwl’s Entity API for searching darknet data.

Key points

• IoCs are forensic artifacts that can indicate a past or ongoing intrusion or malicious activity.
• IoAs focus on behaviors suggesting an attack is underway or imminent, unlike IoCs, which indicate a compromise may already have occurred.
• Organizations use IoCs to investigate incidents, guide response, improve defenses, and share threat information.
• IoCs can be exchanged through threat intelligence platforms using formats and protocols such as STIX and TAXII, as well as through feeds and information-sharing organizations.
• The article highlights DarkOwl’s Entity API, which searches its darknet data for exposed entities including email addresses, domains, cryptocurrency addresses, and IP addresses.

Threat Actors

Malware

Products

Industries

Related Articles

• Brazil Arrests Suspect in Case Tied to USDoD’s Alleged HacksUsDoD
• BreachForums Returns After FBI Seizure as Users Speculate About Law-Enforcement HoneypotUsDoD