indicator of compromise
a clue that shows a system has already been broken into
An indicator of compromise is a specific trace an attack leaves behind. It might be an unexpected file, a known attacker address in the logs, or an unusual process. Security teams search their systems for these clues to find out whether an attack has already succeeded. Vendors and governments publish them after studying real attacks.
Think of it as
Muddy footprints and a forced window latch: signs someone has already been inside.
Ideas that use this term