What does IoC stand for?
IoC stands for Indicator of Compromise. An indicator of compromise: evidence that a system has been breached, such as a malicious hash, domain, IP address or unusual process.
An IoC is a piece of evidence that a system has been compromised. Typical indicators are file hashes, IP addresses, domain names, registry keys and unusual account activity. Teams share them so that others can search their own environment for the same traces. An IoC shows that something already happened, which is its limit: attackers can change a hash or an address in minutes.
IoC in practice: an example
A threat report lists the hash of a malware file and the domain it contacts. An analyst searches the EDR for the hash and the DNS logs for the domain. Two laptops resolved the domain last week, so they are isolated and examined.
What IoC is confused with
IoC vs IoA: what is the difference?
An indicator of attack describes behaviour in progress, such as a process dumping credentials. An IoC is the trace left behind afterwards.
IoC vs TTP: what is the difference?
Tactics, techniques and procedures describe how an attacker operates. They are harder for the attacker to change than a hash or an IP address, so detections built on them last longer.
Which exams cover IoC?
IoC is on the official CompTIA acronym list for one of the four exams covered here.
- CySA+ CS0-004: 1.4 (Security Operations).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. Which of these is an indicator of compromise?
- A planned maintenance window
- The hash of a known malicious file found on a server
- A new firewall rule request
- An expired software licence
Show the answer
B. The hash of a known malicious file found on a server. A known-bad file hash on a host is evidence that the host was compromised.
2. A team blocks every IP address from a threat feed, yet the same attacker returns the next day. Why?
- IP addresses are easy for an attacker to change
- Threat feeds are always wrong
- Firewalls cannot block IP addresses
- The attacker used IPv6 only
Show the answer
A. IP addresses are easy for an attacker to change. Simple indicators such as addresses and hashes are cheap to replace. Detecting the attacker's techniques is more durable.
Sources: NIST glossary: indicator of compromise; NIST SP 800-150, Guide to Cyber Threat Information Sharing. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.