## Indicators of Compromise (IOCs)\n\n### What are IOCs?\n\nIOCs are artifacts that indicate a potential intrusion or malicious activity. They are the "fingerprints" of attacks.\n\n### Pyramid of Pain\n\nDavid Bianco's Pyramid of Pain shows the difficulty for attackers to change indicators:\n\n```\n           ┌────────────┐\n           │   TTPs     │  ← Very Hard (behavior)\n          ┌┴────────────┴┐\n          │    Tools     │  ← Hard\n         ┌┴──────────────┴┐\n         │  Network/Host  │  ← Annoying\n         │   Artifacts    │\n        ┌┴────────────────┴┐\n        │  Domain Names    │  ← Simple\n       ┌┴──────────────────┴┐\n       │   IP Addresses     │  ← Easy\n      ┌┴────────────────────┴┐\n      │     Hash Values      │  ← Trivial\n      └──────────────────────┘\n```\n\n### IOC Types & Value\n\n| Type | Example | Attacker Effort to Change |\n|------|---------|---------------------------|\n| **Hash** | SHA256 of malware | Trivial (1 byte change) |\n| **IP** | C2 server IP | Easy (new server) |\n| **Domain** | C2 domain | Simple (new domain) |\n| **Artifact** | Mutex, registry key | Annoying |\n| **Tool** | Cobalt Strike, Mimikatz | Hard (new tooling) |\n| **TTP** | Process injection | Very hard (new techniques) |\n\n### IOC Lifecycle\n\n1. **Generation**: Extract from analysis\n2. **Validation**: Verify accuracy, check false positives\n3. **Enrichment**: Add context, confidence scores\n4. **Distribution**: Share with consumers\n5. **Consumption**: Ingest into detection tools\n6. **Expiration**: Age out stale indicators