WTF are indicators of compromise?
Short version
Indicators of compromise are the tracks an attacker leaves behind, like a rogue account, file or domain.
The briefing
- NIST's definition
- A technical artifact or observable that suggests an attack is imminent or underway, or that a compromise may already have occurred.
- In plain terms
- Boot prints in the mud.
- Specific tracks
- Advisories usually give you things to hunt for, such as a domain the malware talks to or a repository it creates.
- Real example
- CISA called out webhook.site connections and a public repository named Shai-Hulud in its 2025 npm alert.
- General tracks
- CISA's ransomware guide lists newly created services, unexpected scheduled tasks, unexpected software, new accounts or accounts with escalated privileges and abnormal amounts of data going out.
- "Check for signs of compromise"
- Do not patch and walk away. Find out if someone got in before you shut the door.
- A clean search
- It only means you did not find those tracks. It is not proof nobody was there.
In the Threat Brief this looks like:
Check for signs of compromise: connections to example.net and a new repository named example-worm.
Those are the tracks to hunt for. Search for them even if you have already patched.
Example only. The product, versions and names are made up.
What to do
- If you ran the affected version, search your logs, lock files and machines for what the advisory lists.
- If you find something, do not start wiping.
- Follow CISA's ransomware guide: determine which systems were impacted, isolate them and take a system image and memory capture from a sample of affected devices.
- Keep the evidence, get help if you need it and rotate the credentials that system could reach.