Simple: everyday language, with no technical background needed.
Understand it
An indicator of compromise is information used to help identify possible malicious activity, such as a file hash or a domain associated with an investigation. Tactics, techniques and procedures describe adversary goals, methods and implementations.
An indicator might say “look for this hash.” A behavior description might say “an interpreter was launched from an unusual parent and made an outbound connection.” The first is specific; the second can remain useful when a file or address changes.
Under the hood
An observable is not automatically an indicator. A domain becomes actionable only when evidence, confidence, time and purpose justify using it. Shared infrastructure, reassigned addresses and changing ownership can make a once-useful indicator misleading.
ATT&CK tactics describe goals and techniques describe ways of achieving them. A procedure is a particular implementation. Behavior-based detection also has false positives: administrative work can share the same technique-level characteristics as adversary activity.
Practitioner perspective
Record provenance, confidence, first and last observations, intended use and expiry or review policy. Decide whether an item is suitable for enrichment, hunting, alerting or blocking. Those actions have different costs and require different confidence.
Do not infer a named actor from a single shared indicator or technique. Attribution needs multiple independent lines of evidence and remains uncertain. Evaluate intelligence by the decisions it improves, not the number of indicators imported.
Watch it work
A fictional, simplified model. Select a component to inspect it, or follow the steps in order.
Explore the system
Observed hash
A known sample has a particular hash.
Read every step without animation
Specific indicator
- Observed hash. A known sample has a particular hash.
- Exact match. A matching file is found on a device.
- Context check. The analyst verifies source, time and the file’s role.
An exact match answers a narrow question.
Behavior pattern
- Execution chain. A document starts an unexpected interpreter.
- Pattern correlation. Process and network events fit a hypothesis.
- Investigate. The analyst checks legitimate explanations and additional evidence.
Behavior can outlast an indicator, but is not automatically malicious.
Attack view
The fictional adversary changes a file hash while continuing a similar execution pattern. Exact-match detection and behavioral analysis see different parts of that change.
Defender view
- Use specific indicators and behavior together.
- Review indicator age, context and false-positive cost.
- Separate an observation from an attribution claim.
Common mistakes
- A match is a lead, not automatic proof of compromise.
- A technique is not uniquely owned by one threat actor.
Check your understanding
Active recall: explain this idea in 30 seconds
An indicator of compromise is information used to help identify possible malicious activity, such as a file hash or a domain associated with an investigation. Tactics, techniques and procedures describe adversary goals, methods and implementations.
Now give an example and name one limitation. Revisit the explanation if you get stuck.
Primary sources
Original explanations informed by these specifications and official resources. Source versions and lesson review are separate from product updates.
Content reviewed 2026-09-10. Read the editorial policy.