Indicators of compromise (IoC)

An indicator of compromise (IoC) is a technical trace left by an intrusion: the SHA-256 (Secure Hash Algorithm) hash of a malicious binary, the IP address of a command-and-control server, a domain name, a registry key created for persistence, an innocuously named scheduled task. On November 17, 2022, CISA (Cybersecurity and Infrastructure Security Agency), the FBI (Federal Bureau of Investigation) and the U.S. Department of Health and Human Services released joint advisory AA22-321A, “#StopRansomware: Hive”, with the group's techniques and indicators of compromise identified as recently as November. An indicator of attack (IoA) describes behavior in progress, such as an admin tool launched from an accounting workstation at 3 a.m. IoCs go stale fast: attackers rotate addresses within hours, and a hash changes the moment a byte moves. They travel in shared formats, STIX (Structured Threat Information Expression) to describe them and TAXII (Trusted Automated Exchange of Intelligence Information) to carry them, and on platforms such as MISP (Malware Information Sharing Platform), fed by CSIRTs (computer security incident response teams) and sector communities. Article 23(4)(b) of Directive (EU) 2022/2555 expects the 72-hour notification of a significant incident to give an initial assessment of its severity and impact and, where available, the indicators of compromise. For the cyber underwriter, the IoC first shows up in claims. Sweeping the insured's logs for the indicators in a public advisory (a compromise assessment) is billed as forensic cost, and the wording decides whether it is covered before anything has been reported: many policies require an incident discovered or reasonably suspected. It then weighs on attribution, since indicators shared with a sanctioned group change the conversation about a ransom. A caveat: a single IoC proves little, and a shared hosting IP address can produce a false positive that triggers a needless report.