Indicators of Compromise (IoCs) are clues, artifacts, or evidence that suggest a potential intrusion or malicious activity within an organization's infrastructure. IoCs are used to identify and respond to security breaches and can include log entries, file hashes, unusual network traffic, or specific patterns that match known threats.
* Indicators of Attack (IoA): Focus on detecting the methods and techniques used by attackers.
* Key Risk Indicators: Metrics that indicate increased risk levels.
* Indicators of Exposure: Signs that reveal vulnerabilities or weaknesses in the system.
References:
* EC-Council Certified Network Defender (CND) Study Guide
* Threat detection and incident response documentation