Indicators of compromise

Detects populated indicator-of-compromise lists and packages: IOC wording together with concrete indicator values such as file hashes, C2 domains or IPs, defanged URLs, mutexes or registry keys. The IOC phrase alone is discovery-only.

Type

regex

Engine

boost_regex

Confidence

medium

Confidence justification

Medium confidence: the topic phrase alone is discovery-only; enforcement needs populated structure (a labelled indicator field (hash, C2, malicious IP/domain/URL, mutex, registry key) with a value or a machine indicator (MD5/SHA1/SHA256 hex, defanged hxxp or [.] indicator, IPv4 address)), and 85 needs two distinct structures plus independent threat-context (first/last seen, actor, TLP, EDR, ATT&CK) evidence, so policies, blank forms and training text stay below 75.

Detection quality

Topic verified

Jurisdictions

global

Regulations

Security of Critical Infrastructure Act 2018 (Cth)

Frameworks

ISO 27001, NIST CSF, CIS Controls

Data categories

security

Scope

wide

Risk rating

4

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:IOCs?|indicators?\s+of\s+compromise|IOC\s+(?:list|package|bundle|feed|report))\b

Corroborative evidence keywords

first seen, last seen, threat actor, TLP:AMBER, TLP:RED, sinkhole, EDR, MITRE ATT&CK, detection rule, blocklist

Proximity: 300 characters

Should match

• The SOC shared its IOC list with the partner agency after the phishing campaign. — Discovery probe (65) - IOC wording without indicator values
• IOC package - incident 2026-114 C2 domain: update-check.harbourcdn.net Malicious IP: 185.220.101.47 — Medium-tier probe (75) - labelled indicators without threat context
• Indicators of compromise - Operation Tidewater (TLP:AMBER) SHA256: 3f79bb7b435b05321651daefd374cdc681dc06faa65e374e38337b88ca046dea C2 domain: update-check.harbourcdn.net Callback URL: hxxps://update-check[.]harbourcdn[.]net/gate.php First seen: 2026-09-12 03:14 UTC; threat actor overlaps with prior loader activity. — High-tier probe (85) - hash, labelled C2 fields, defanged URL, TLP and first-seen context

Should not match

• unrelated generic text — No relevant phrase context
• placeholder value 12345 — Random text should not match
• Policy statement: IOC feeds received from partners must be reviewed by the SOC within 24 hours and loaded into the blocklist. — Policy naming IOCs without indicator values
• IOC report template SHA256: ________ C2 domain: [insert] Malicious IP: ________ — Blank template - labels without values
• Media release: researchers published indicators of compromise, including the IP 185.220.101.47, for a widespread ransomware campaign. — News framing with a public indicator is excluded

Known false positives

• Public advisories and vendor blogs publish IOC lists with hashes and defanged domains. Mitigation: Guidance/news/press-release framing is excluded; public advisories that carry full IOC tables can still reach 75 and should be handled with site or sender exceptions.
• Security awareness or training material explains what an IOC is. Mitigation: Topic wording alone is discovery-only; training and course framing is excluded from enforce tiers.

References

• Information Security Manual (ISM)
• Security of Critical Infrastructure Act 2018 (Cth)
• Data breach preparation and response (OAIC)
• APRA CPS 234 Information Security
• NIST SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management
• MITRE ATT&CK