📖 What is Indicator of Compromise (IoC)?
An Indicator of Compromise (IoC) is a piece of digital evidence, such as a file hash, IP address, or registry key, that indicates a system has been breached. These artifacts are used by security analysts to detect intrusions and map adversary activity.
"For the exam, distinguish between artifacts, which are what the attacker left behind, and IoCs, which are the specific signatures used to identify that breach."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of Indicator of Compromise (IoC)?
- ▸ Network-based IoCs include malicious IP addresses, domain names, and unusual traffic patterns used to identify command-and-control (C2) communication during a security assessment.
- ▸ Host-based IoCs consist of file hashes, modified registry keys, and unexpected system files that signal the presence of malware or unauthorized tools on a target.
- ▸ The Pyramid of Pain ranks IoCs by the effort required for an attacker to change them, moving from trivial hashes to challenging TTPs.
- ▸ Threat intelligence feeds allow organizations to automate the detection of known adversary infrastructure by integrating IoCs into SIEM or IDS/IPS security solutions.
- ▸ False positives occur when legitimate system activity mimics an IoC, requiring a penetration tester or analyst to validate findings before confirming a breach.
🎯 How does Indicator of Compromise (IoC) appear on the PT0-002 Exam?
You may be asked to analyze a list of evidence—such as a known malicious file hash, a suspicious IP, or a modified system binary—and identify which specific items qualify as Indicators of Compromise.
A scenario might describe a red team engagement where you must simulate a known threat actor's behavior by utilizing specific IoCs to test the effectiveness of the client's detection capabilities.
Expect questions regarding the Pyramid of Pain, where you must determine which type of indicator, such as a file hash versus a behavioral TTP, is most difficult for an adversary to modify.
❓ Frequently Asked Questions
What is the fundamental difference between a forensic artifact and an IoC?
An artifact is any piece of evidence left behind by an attacker, while an IoC is a specific, recognized signature—like a known bad hash—used to definitively identify a known threat.
Why are file hashes considered the easiest IoCs for attackers to evade?
Attackers can easily bypass hash-based detection through polymorphism, where they change a single bit of the file to create a completely new hash without altering the malware's core functionality.
How do IoCs differ from TTPs in the context of threat hunting?
IoCs are static markers of a breach (the 'what'), whereas TTPs describe the behavioral patterns and strategies of the attacker (the 'how'), providing a more durable method of detection.