Glossary
IOC (indicator of compromise)
An indicator of compromise is an observable artefact of an intrusion, such as a hash, domain, mutex or file pattern.
Indicators of compromise include file hashes, IP addresses, domains, URLs, mutex names, registry keys and file patterns. Hashes identify one exact file; a YARA rule is a more flexible indicator that can match every build of a tool sharing the same strings or code.
Many rules list the hashes of the samples they were built from in their meta section. See writing rules for incident response.