Indicator of compromise (IoC)
Also called: IoC
Course: AP® Cybersecurity Shows up in: Unit 3: Securing Networks
Evidence in data or traffic that a system may be under attack, such as connections to known malicious addresses or mismatched port and application traffic.
Appears in the course and exam description (CED): 3.5.C.13.5.E.7
Why it matters in Unit 3
Signature databases are lists of known IoCs.
Example
Web traffic showing up on port 22.
Learn it properly, with a checkpoint 3.5 Detecting Network Attacks