Indicators of Compromise (IoC)
Learn to recognize IoCs — file hashes, IP addresses, domain names, and behavioral patterns — that signal a potential breach or attack.
Indicators of Compromise (IoC) is a free Cloud & IT Cert Prep lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cloud & IT Cert Prep learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What Are Indicators of Compromise?
Indicators of Compromise (IoCs) are the digital fingerprints attackers leave behind. Teams collect them to build detections and hunt for signs of an attack.
File-Based IoCs: Hashes
A file hash is a precise IoC — match a file's hash to known malware and it's almost certainly bad. But changing one byte changes the hash, so it's brittle.
# Compute SHA-256 hash of a suspected malicious file
sha256sum suspicious_file.exe
# Output: 4a5678bc... suspicious_file.exe
# Search for this hash in threat intelligence platforms
# curl 'https://www.virustotal.com/api/v3/files/4a5678bc...' -H 'x-apikey: KEY'
# Windows equivalent
Get-FileHash suspicious_file.exe -Algorithm SHA256Network-Based IoCs: IP Addresses and Domains
IP addresses and domains are network IoCs, since malware phones home to command servers. Attackers dodge blocklists by cycling addresses and auto-generating domains.
# Check if a domain is listed as malicious (using DNS blacklist)
dig +short 198.51.100.1.zen.spamhaus.org
# A response means the IP is listed as malicious
# Block a malicious domain at DNS level (Linux /etc/hosts sinkhole)
echo '0.0.0.0 malware-c2.evil.com' >> /etc/hosts
# Query firewall logs for known bad IP
grep '203.0.113.45' /var/log/firewall.logURL and URI Indicators
A URL IoC can be very specific — one bad page on an otherwise trusted site. Watch out for shortened links that hide where they really lead.
Registry and File System IoCs (Windows)
On Windows, malware hides in persistence spots: Run registry keys, the Startup folder, scheduled tasks, and temp directories. Investigators check these first.
# Check common persistence locations on Windows
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
# List scheduled tasks (look for unusual entries)
schtasks /query /fo LIST /v | findstr /i 'task name status'
# Check startup folder contents
dir '%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup'Behavioral IoCs: Anomalous Patterns
Behavioral IoCs flag unusual activity instead of files — a 3am login, a huge data upload, or a Word doc launching PowerShell. They're harder for attackers to dodge.
Pyramid of Pain for IoCs
The Pyramid of Pain ranks IoCs by how much it hurts an attacker to change them. Hashes and IPs are easy to swap; their TTPs are the hardest — and most valuable to detect.
Detecting IoCs with SIEM Rules
A SIEM correlates logs to catch IoCs at scale — like a login from a blocklisted IP, or the same user appearing in two countries within an impossible window.
# Example Splunk SPL rule for impossible travel IoC
# Detect same user logging in from two countries within 1 hour
index=auth_logs sourcetype=ldap action=login
| sort 0 user, _time
| streamstats current=f last(src_country) as prev_country last(_time) as prev_time by user
| where src_country != prev_country AND (_time - prev_time) < 3600
| table user, src_country, prev_country, _timeIoC Lifecycle: Freshness Matters
IoCs have a shelf life. An attacker may abandon a command server within hours, so old indicators cause false positives. Tag them with confidence and expiry dates.
Email Header Analysis for IoCs
Phishing emails hide IoCs in their headers — the real sender, relay chain, and originating IP — plus the links and attachments. Header analysis is key to triage.
# Extract IoCs from an email file (.eml) using Python
import email
with open('suspicious.eml', 'r') as f:
msg = email.message_from_file(f)
# Extract sender information
print('From:', msg['From'])
print('Return-Path:', msg['Return-Path'])
print('Received:', msg.get_all('Received'))
# Then extract and analyze any URLs in the bodyIoCs vs Indicators of Attack (IoA)
An IoC shows a past compromise, but an Indicator of Attack (IoA) spots intent in real time — like a process enumerating accounts — catching even unknown malware.
Quick Check
Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.
Lesson Recap
Quick recap: IoCs include hashes, IPs, domains, registry keys, and behavior; the Pyramid of Pain shows TTPs are most resilient; and IoCs need lifecycle management. Next: symmetric encryption.
Frequently asked questions
Is the “Indicators of Compromise (IoC)” lesson free?
Yes — the full text of “Indicators of Compromise (IoC)” is free to read here on the web, and the Cloud & IT Cert Prep course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cloud & IT Cert Prep course, upgrade to CoddyKit PRO.
What will I learn in “Indicators of Compromise (IoC)”?
Learn to recognize IoCs — file hashes, IP addresses, domain names, and behavioral patterns — that signal a potential breach or attack. You practise Cloud & IT Cert Prep with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cloud & IT Cert Prep?
No prior experience is required. Cloud & IT Cert Prep on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Indicators of Compromise (IoC)” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cloud & IT Cert Prep lesson?
Yes. Every Cloud & IT Cert Prep lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Types of Threat Actors
- Attack Vectors and Attack Surfaces
- Threat Intelligence Sources and Feeds
- Indicators of Compromise (IoC)