IOC Types and Confidence
Not all indicators of compromise are equally useful, equally durable, or equally actionable. A file hash changes the moment an attacker recompiles. An IP address gets rotated in minutes. A behavioral TTP can persist across an entire campaign spanning years. Understanding the difference between these indicator types, and how to score confidence in them, determines whether a CTI feed improves or degrades analyst decision-making.
IOC Taxonomy
An indicator of compromise is a forensic artifact or observable that suggests a system may have been compromised or that adversary activity is present. The word "may" is intentional: indicators are probabilistic, not deterministic. What you do with one depends on the confidence level, the context, and what other signals are present.
Network Indicators
IP addresses, domain names, and URLs. An IP address identifies a server that was used in a campaign. A domain name is one step more durable than an IP because the attacker can point a domain at new IPs without changing the domain itself. A URL is the most specific: a particular path on a particular host. Network indicators are highly shareable, easy to automate into blocklists, and fast to decay: an actor who notices their infrastructure is being burned will rotate it quickly.
Host Indicators
File hashes, file names, registry keys, mutex names, and file paths. File hashes (MD5, SHA-1, SHA-256) are the most common host indicator and are deterministic for a specific file: the same file always produces the same hash. This is also their weakness. Recompiling a binary with a minor change produces a completely different hash, and attackers who know their malware is burned recompile and redeploy. SHA-256 is preferred over MD5 for hash verification due to MD5's collision vulnerabilities, though neither solves the trivial recompilation problem.
Email Indicators
Sender addresses, subject line patterns, attachment names, and email header fields. They are commonly extracted from phishing campaigns and are useful for blocking delivery of follow-on waves after an initial attack. Like IP addresses, email sender domains rotate quickly as actors burn through infrastructure.
Behavioral Indicators
Describe how an attacker operates rather than what artifacts they leave. A behavioral indicator might be: "actor executes PowerShell with base64-encoded content, immediately followed by a process injection into svchost.exe, followed by LDAP reconnaissance against the domain controller." No specific hash, no specific IP, no specific domain: the behavior is the indicator. These are the most durable indicators because they describe what an actor must do to accomplish their objective, not the particular tools they use to do it.
| Indicator Type | Examples | Decay Rate | Blocking Ease |
|---|---|---|---|
| IP Address | 185.220.101.45 | Hours to days | Easy (firewall/SIEM) |
| Domain | update-service-cdn.com | Days to weeks | Easy (DNS block) |
| URL | /wp-content/uploads/payload.php | Hours to days | Medium (proxy) |
| File Hash | SHA-256 of malware binary | Hours (recompile) | Easy (EDR/AV) |
| Behavioral TTP | PowerShell + process injection + LDAP recon chain | Months to years | Hard (requires behavioral detection) |
The Pyramid of Pain
David Bianco's Pyramid of Pain is the most useful single framework for understanding indicator value in threat intelligence. It organizes indicators by the cost they impose on an adversary when defenders detect and respond to them, across six levels: the bottom levels are easy to detect but easy for the attacker to change, the top levels are hard to detect but almost impossible for the attacker to change without fundamentally altering how they operate.
| Level (base to apex) | Cost to Attacker When Blocked | Why |
|---|---|---|
| Hash values | Almost none | Recompile with a minor modification, pad the binary, or swap a string and the hash changes completely. Hash-based detection is reactive: by the time you have the hash, the sample has already executed somewhere. Hashes still have value as confirmation and forensic evidence, but not as a proactive detection mechanism. |
| IP addresses | Mild | The attacker must pay for a new server or rotate to a different bulletproof hosting provider, which with automation can happen in under an hour. Sophisticated actors maintain large pools of rotating infrastructure specifically to defeat IP-based blocking. |
| Domain names | Moderate | Registering a new domain, setting up DNS, and deploying it takes longer than rotating an IP. Some actors use DGA (domain generation algorithms) to produce fallback domains, but the algorithmic patterns can themselves become signatures. |
| Network artifacts | Real pain | Specific HTTP headers, User-Agent strings, URI patterns, and SSL certificate fingerprints are often baked into implant behavior. Changing the team server configuration, beacon profile, and certificate together mid-campaign introduces operational risk. |
| Tools | Significant | If defenders detect the specific malware family, RAT, or post-exploitation framework, the actor must switch tools entirely. Developing or acquiring a new tool is expensive and time-consuming. |
| TTPs (apex) | Maximum | TTPs describe an actor's fundamental operational behavior. To change them, the actor must retrain, redevelop, and potentially rebuild their entire intrusion methodology. A detection anchored at TTP level catches the actor whether they use Cobalt Strike, Metasploit, or a custom implant. |
IOC Confidence Scoring
Confidence scoring answers how certain we are that an indicator is genuinely associated with adversary activity, and how certain we are that it is still relevant. Without confidence scores, every indicator in a blocklist gets treated identically, which means a high-fidelity TTP-level detection and a low-confidence IP from a single uncorroborated source both fire with equal authority. That is not a workable operating model at scale.
The Four Scoring Factors
- Source quality: an IP extracted from a vetted government ISAC report with documented campaign attribution carries different weight than the same IP from a public pastebin scrape. Source categories, from most to least reliable, generally run: direct victim telemetry (observed in your own environment), a trusted sharing partner with documented methodology, a commercial intelligence provider with disclosed collection practices, open-source research from reputable vendors, and unvetted public feeds.
- Corroboration: an indicator seen in a single report is low confidence. The same indicator appearing in three independent reports from different vendors using different collection methods is high confidence. Independence is critical: if three vendors are all citing the same original source, that is one data point, not three.
- Recency: an IP address from a campaign six months ago may have been decommissioned, taken over by a sinkhole, or repurposed by an unrelated actor. A domain registration that expired and was re-registered is no longer the actor's. Technical indicators depreciate quickly; behavioral TTPs depreciate slowly.
- Context specificity: does this indicator apply to your environment? An IP associated with attacks on Japanese financial institutions is a lower-confidence signal for a North American healthcare provider than the same IP associated with attacks on healthcare targets globally. Sector, geographic, and organizational-size relevance all affect whether an indicator should trigger defensive action in your specific context.
IOC Lifecycle
An indicator of compromise does not remain valid indefinitely. It has a lifecycle that begins at collection and ends when the indicator is retired as no longer reliable or relevant. Managing this lifecycle is one of the least glamorous and most important parts of CTI operations.
Provenance and Validation
Provenance is essential because it determines the indicator's starting confidence and enables reassessment if the source is later found to be unreliable. Validation confirms the indicator is not already known as benign: IP addresses must be cross-checked against CDN ranges, known benign scanning services (Shodan, Censys scan ranges), and your organization's own infrastructure, while domains must be checked against newly registered domain feeds, DGA dictionaries, and parking services. A surprising fraction of "malicious" indicators in public feeds are shared scanning infrastructure, CDN exit nodes, or research honeypots.
Enrichment Makes an IOC Actionable
A bare IP address tells an analyst nothing. An IP address with ASN attribution to a known bulletproof hosting provider, associated with three known malware families, first observed in a specific campaign, tells an analyst a great deal. That is the difference enrichment makes.
Deployment Tier Matches Confidence
High-confidence indicators with strong corroboration can go directly to blocking. Low-confidence indicators should go to alerting-only so analysts can review before action is taken.
Review Cadence by Indicator Type
- Technical indicators (IPs, hashes): reviewed within 30 days.
- Domain indicators: reviewed within 90 days.
- Behavioral indicators: can persist longer but should still be reviewed annually for continued relevance.
Indicators that fail review should be retired, not left in place to accumulate false positives indefinitely. Review and retirement are where most CTI programs fail.
Indicator Context
A bare indicator without context is an obstacle, not an asset. When an analyst receives an alert that an internal host communicated with a flagged IP, the useful question is not "is this IP bad" but "what does this IP tell us about what happened and who did it." Answering that question requires context beyond the indicator itself.
Kill Chain Position
Does this indicator appear in initial access (phishing delivery IP), command and control (beacon endpoint), or exfiltration (destination of outbound data transfer)? The kill chain position tells the analyst what phase of the attack they are observing and what is likely to have come before and after. A C2 indicator means dwell time has already occurred. An exfiltration indicator means data has likely already left.
Actor Attribution
If an IP address is associated with a known APT group, the analyst can immediately apply existing knowledge about that actor's TTPs, typical targets, and usual post-exploitation behavior. Attribution is probabilistic, but even low-confidence attribution to a category (financially motivated actor vs nation-state) changes the response priority and scope.
Related Indicators (Pivoting)
Related indicators extend the value of any single IOC through pivoting: a domain leads to its IP, that IP leads to other domains sharing the same infrastructure, those domains lead to certificate fingerprints, and certificate fingerprints lead to additional IPs. A single IOC with good enrichment can open a pivot chain that maps a significant portion of an actor's infrastructure. Chapter 5 covers this pivot workflow in detail in the context of intel-driven hunting.
False Positive Risk
An IP on an APNIC range in a region associated with threat activity is not the same as an IP that appears in multiple vendor reports with direct evidence of malicious use. Blocklisting a shared hosting IP because it appeared once in a low-fidelity feed is how teams get an angry call from a business partner whose legitimate web presence just went dark. Context includes knowing the limitations and false positive profiles of your sources.
IOC Quality vs Quantity
The most common indicator program failure is optimizing for quantity. Teams subscribe to more feeds, ingest more indicators, build bigger blocklists, and measure success by the number of IOCs in the database. At a certain scale this approach produces nothing but alert fatigue, and alert fatigue produces the same outcome as no detection at all: analysts stop investigating.
Feed Fatigue Is Well-Documented
A SOC that receives 50,000 threat feed hits per day and closes 80% without investigation because they are known false positives has not built a CTI-enhanced detection capability. It has built a noise machine. The time spent handling low-fidelity feed hits is time not spent investigating higher-priority signals, and the opportunity cost is significant.
Curation Is the Solution
A curated set of 500 high-confidence, context-enriched, recently validated indicators will outperform a firehose of 500,000 bare IOCs every time. Curation requires human judgment: reviewing sources, applying confidence scoring, validating against environment, and retiring stale indicators. It is more work than subscribing to a feed and ingesting everything, but it produces a system analysts trust and use rather than one they suppress.
Evaluate Feeds Regularly
Measure the true positive rate of each feed: how many hits from this feed resulted in confirmed malicious activity versus false positives? Feeds with consistently poor TP rates should be deprioritized or eliminated. Feeds that consistently surface high-confidence, well-contextualized indicators should get more attention and integration.
Internal Telemetry Often Outperforms External Feeds
IOCs observed directly in your own environment, extracted from endpoint forensics or network captures during incident response, carry the highest possible confidence because you have direct evidence of malicious use in your specific context. Building a program to capture, enrich, and operationalize internal indicators is usually more valuable than adding another external feed subscription.
Key Takeaways
- IOC types range from network (IP, domain, URL) to host (hash, registry key, mutex) to behavioral (TTP-level patterns). Each has different durability and different blocking difficulty.
- The Pyramid of Pain maps indicator types to the cost imposed on an adversary when defenders act on them. Hash and IP indicators impose minimal cost. TTP-level detections impose maximum cost.
- Confidence scoring should factor in source quality, corroboration from independent sources, recency, and relevance to your specific environment and sector.
- Every IOC has a lifecycle: collection, validation, enrichment, deployment, review, and retirement. Stale indicators in blocklists generate false positives and erode analyst trust.
- Context transforms a bare indicator into intelligence: kill chain position, actor attribution, related indicators via pivoting, and false positive risk profiles.
- Optimize for IOC quality over quantity. A curated, validated, context-enriched indicator set outperforms a large unfiltered firehose every time.
Knowledge Check
Click an answer to reveal the explanation.
An actor recompiles their malware with a minor string change. Which defense does this defeat?
You receive the same IP address from three different threat intelligence feeds. What must you verify before treating this as high-confidence corroboration?
Your SOC receives 10,000 threat feed hits per day. Analysts investigate 20% and close the rest as presumed false positives without review. What is the primary problem?