Indicator of Compromise

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

A | B | C | D | E | F | G | H | I | J | K | L | M | N | O | P | Q | R | S | T | U | V | W | X | Y | Z

Abbreviations / Acronyms / Synonyms:

IoC

NIST SP 1800-8b

IOC

NIST SP 800-53 Rev. 5

Definitions:

Technical artifacts or observables that suggest that an attack is imminent or is currently underway or that a compromise may have already occurred.
Sources:
NIST SP 800-61r3 under indicators of compromise from NIST SP 800-150 - adapted

About

See the identified Source document to understand each term-definition pair in its proper context.

Send inquiries about terminology to the Source's authors; NIST publications will usually include a contact email for that Source.

For other inquiries, such as comments about the Glossary's presentation and functionality, use this link.

See the Glossary homepage for more guidance.