# WTF are indicators of compromise?

> Sarge says: Patched is not clear. Check for boot prints before you stand down.

- Term: Indicators of compromise
- Also called: indicator of compromise; IoC; IoCs; signs of compromise; check for signs of compromise
- Section: Under attack
- Web page: https://codemarine.ai/learn/indicators-of-compromise/

## Short version

Indicators of compromise are the tracks an attacker leaves behind, like a rogue account, file or domain.

## The briefing

- **NIST's definition:** A technical artifact or observable that suggests an attack is imminent or underway, or that a compromise may already have occurred.
- **In plain terms:** Boot prints in the mud.
- **Specific tracks:** Advisories usually give you things to hunt for, such as a domain the malware talks to or a repository it creates.
- **Real example:** CISA called out webhook.site connections and a public repository named Shai-Hulud in its 2025 npm alert.
- **General tracks:** CISA's ransomware guide lists newly created services, unexpected scheduled tasks, unexpected software, new accounts or accounts with escalated privileges and abnormal amounts of data going out.
- **"Check for signs of compromise":** Do not patch and walk away. Find out if someone got in before you shut the door.
- **A clean search:** It only means you did not find those tracks. It is not proof nobody was there.

## In the Threat Brief this looks like

> Check for signs of compromise: connections to example.net and a new repository named example-worm.

Those are the tracks to hunt for. Search for them even if you have already patched.

Example only. The product, versions and names are made up.

## What to do

- If you ran the affected version, search your logs, lock files and machines for what the advisory lists.
- If you find something, do not start wiping.
- Follow CISA's ransomware guide: determine which systems were impacted, isolate them and take a system image and memory capture from a sample of affected devices.
- Keep the evidence, get help if you need it and rotate the credentials that system could reach.

## Official sources

- [NIST CSRC Glossary: indicator](https://csrc.nist.gov/glossary/term/indicator)
- [CISA: #StopRansomware Guide](https://www.cisa.gov/stopransomware/ransomware-guide)
- [CISA: Widespread Supply Chain Compromise Impacting npm Ecosystem](https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem)
- [CISA: BOD 26-04, Prioritizing Security Updates Based on Risk](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk)

## Related

- [Supply chain attack](https://codemarine.ai/learn/supply-chain-attack.md)
- [Exploited in the wild](https://codemarine.ai/learn/exploited-in-the-wild.md)
- [Patch and advisory](https://codemarine.ai/learn/patch-and-advisory.md)