Indicator of compromise

Common IoCs include virus signatures, suspicious IP addresses, MD5 hashes of malware files, and malicious URLs or domain names associated with botnet command-and-control servers. Once IoCs are identified through incident response or forensic analysis, they can be used for early detection of future attacks with intrusion detection systems and antivirus software. == Automation and sharing ==

Several standards and initiatives aim to automate IoC processing and sharing: • The Incident Object Description Exchange Format (IODEF) standardizes how incident information is described and exchanged. • Structured Threat Information Expression (STIX) is used to represent cyber threat information. Known indicators are often exchanged within the cybersecurity industry, commonly using the Traffic Light Protocol (TLP) to indicate how information may be shared. Other frameworks and standards are also used to support secure information sharing. == See also ==