What it means
Examples include malicious infrastructure, file hashes, unusual process relationships, credential use, persistence changes, suspicious queries, and unexpected data movement.
Why it matters
Indicators are most useful when combined with context, time, confidence, and an understanding of how easily an attacker can change them.
Practical focus
- Record source, confidence, time, and scope
- Combine atomic indicators with behavioral detections
- Search historical telemetry when new indicators arrive
- Expire or reassess stale intelligence
Common mistakes
- Blocking an indicator without investigating related activity
- Treating one match as proof of compromise
- Keeping indicators forever without validation
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: