Threat Intelligence · 5 min
IOCs vs Behavioral Signals
Why a hash match is a lead, not a verdict
This lesson explains the concept, then checks your understanding in a short interactive exercise.
Indicators of compromise
An IOC is an atomic artifact that has been observed in association with malicious activity.
- IP addresses and domains
- URLs and file paths
- File hashes
- Email senders, subjects, and header artifacts
Indicators decay
Most atomic indicators have a short useful life. Attackers rotate infrastructure cheaply, and a single byte change produces an entirely new file hash.
- Domains get burned and replaced in days
- Cloud and CDN IPs are shared with legitimate tenants
- Hashes break on recompilation or packing
- Stale indicators generate false positives long after the campaign ends
Loading the interactive lesson…