Cybersecurity Indicators of Compromise: Definitions and Scenarios

Indicator of Compromise (IOC)

Evidence that gives high confidence a system has been breached or compromised, such as unusual traffic, changed file hashes, or abnormal login patterns

Account lockout (as an IOC)

An unexpected account lockout, especially one caused by administrative disabling rather than failed password attempts, which may indicate an attacker trying to trigger a fraudulent password reset via social engineering

Impossible travel

An indicator of compromise where a user account shows logins from two geographically distant locations within a timeframe that would be physically impossible to travel between

Blocked access to security resources

An indicator of compromise where a system cannot reach antivirus update servers or security patch sites, often because malware has deliberately disabled these connections to remain undetected

Resource consumption (as an IOC)

Unusual spikes in network traffic, such as high activity at an unexpected time of day, that may indicate data exfiltration or other unauthorized activity

Resource inaccessibility (as an IOC)

A resource becoming suddenly unavailable, which may indicate ransomware encryption, a crashed server from exploitation attempts, or an account locked out from a brute-force attempt

Out-of-cycle logging

Log entries showing activity, such as patches or updates, occurring outside the organization's normal expected schedule, which may indicate unauthorized changes

Missing/deleted logs

An indicator of compromise where expected log data is absent, often because an attacker deleted logs to hide evidence of their activity on a system

Published/exfiltrated data (double extortion)

A clear indicator of compromise where private organizational data appears publicly on the internet, often paired with ransomware where attackers steal data before encrypting it and threaten public release if payment is not made

Scenario: A user account is locked, but no failed login attempts appear in the logs. Later, someone calls the help desk claiming to be that user and asks for a password reset. What is this pattern an indicator of?

Account lockout used as a setup for social engineering a password reset

Scenario: A user logs in from Omaha, Nebraska, and then logs in again from Australia six minutes later. What indicator of compromise does this represent?

Impossible travel

Scenario: A workstation suddenly cannot reach any antivirus update servers or security patch websites. What does this likely indicate?

Blocked access to security resources, often caused by malware disabling updates to remain undetected

Scenario: Network traffic is unusually high at 3:00 AM when the office is normally quiet. What indicator of compromise does this suggest?

Resource consumption (potential data exfiltration)

Scenario: A patch installation appears in the logs on a random Wednesday afternoon, outside the organization's normal scheduled patch cycle. What is this called?

Out-of-cycle logging

Scenario: An investigator notices that expected authentication logs for a specific time period are completely missing from a compromised server. What does this suggest?

Missing/deleted logs, likely an attacker covering their tracks

Scenario: A company discovers its confidential data has been posted publicly online, and separately finds all of its files encrypted with a ransom note. What technique combines both of these tactics?

Double extortion (data exfiltration and publication combined with ransomware)