What is an indicator of compromise (IoC)?
Security operations teams compare logs with known-bad clues called indicators of compromise, or IoCs. In NCSC security-operations guidance, an IoC is a low-level piece of threat intelligence that can be compared with logs. The SOC threat-intelligence chapter gives examples: known-bad IP addresses, domains, hashes and strings. 1
By Secordit. Last checked: 10 November 2026.
How it works
What UK guidance says
The same chapter places IoCs at the lower end of a range of intelligence types. It also discusses attacker tactics, techniques and procedures as a more abstract type of intelligence used for behavioural detection. The chapter discusses the risk of using out-of-date or low-confidence IoCs. The NCSC APT28 advisory of 4 October 2018 is an example of NCSC material that publishes IoCs. It is a technical advisory written for the network defender community. Those indicators are not copied here. 123
Frequently asked questions
What is an indicator of compromise?
In NCSC security-operations guidance, it is a low-level piece of threat intelligence that can be compared with logs. A match would indicate that a system is interacting with a known-bad indicator. 1
What examples does NCSC give?
The SOC threat-intelligence chapter gives known-bad IP addresses, domains, hashes and strings. Those published indicators are not repeated here. 1
Do indicators stay useful?
The same chapter warns about the risk of using out-of-date or low-confidence IoCs, and about the limits of tools and feeds that contain them. 1
News Pulse
Account security, explained by email.
Sources
- NCSC, Building a Security Operations Centre: Threat intelligence (opens in a new tab). Accessed 10 November 2026 (Europe/London).
- NCSC, Indicators of compromise for malware used by APT28 (opens in a new tab). Accessed 10 November 2026 (Europe/London).
- NCSC, Logging and monitoring (opens in a new tab). Accessed 10 November 2026 (Europe/London).