When a security team investigates an intrusion, it collects clues: a file that should not be there, a web address the software phoned home to, a pattern of actions no normal user would take. These clues are called indicators of compromise (IOCs) — observable traces that suggest a system has been attacked. Collecting them is the easy part. The harder, more useful insight is that not all indicators are worth the same, because some are trivial for an attacker to change and others are painful.

What an indicator of compromise is

An indicator of compromise (IOC) is a piece of forensic evidence that a security event may have happened — a specific file, address, or behavior tied to malicious activity. Standards for describing and exchanging them exist so teams and tools can agree on what they mean; the OASIS Structured Threat Information Expression (STIX) format, for example, is a widely used public language for representing indicators.

Indicators are how intelligence becomes concrete. A report saying 'this group is active' is useful context, but an indicator — this exact file hash, this domain — is something a tool can match on automatically. The catch, explored below, is that the most easily matched indicators are also the easiest for an attacker to throw away.

📌
The core idea. An indicator is a concrete, matchable trace of an attack — but its value depends on how hard it is for the attacker to change.

Three kinds of indicator

Indicators come in three broad kinds. Atomic indicators cannot be broken down further and still mean something — a single internet address, a domain name, an email address. Computed indicators are derived by calculation, such as a hash (a short fingerprint computed from a file) or a pattern that matches a family of files. Behavioral indicators describe a sequence of actions — what the attacker did, not just what artifact they left.

The three kinds sit at different depths. Atomic and computed indicators are specific and cheap to match but also specific and cheap to change. Behavioral indicators are fuzzier and harder to write, but they capture how an adversary operates, which is far more stable over time.

Indicators range from single concrete artifacts to whole patterns of behavior. Kinds of indicator Indicator a trace of attack Atomic IP, domain, email Computed hash or pattern Behavioral a sequence of actions
Indicators range from single concrete artifacts to whole patterns of behavior.

Not all indicators are equal

Here is the trap that catches new teams: they collect thousands of file hashes and addresses, load them into their tools, and feel protected. But an attacker can generate a brand-new file (and therefore a brand-new hash) in seconds, and rent a fresh internet address just as fast. Blocking those indicators inconveniences no one.

The useful question is not how many indicators you have, but how much it would hurt the attacker if you denied each one. That question is captured by a well-known public model called the Pyramid of Pain.

⚠️
Volume is not value. A huge list of file hashes feels like protection but blocks only the laziest reuse — the attacker regenerates them at will.

The Pyramid of Pain

The Pyramid of Pain, introduced publicly by security researcher David Bianco, ranks indicator types by how much pain denying them causes the attacker. At the bottom sit hash values: trivial to change, so blocking them barely registers. Above them are internet addresses and domain names — a little more effort to rotate, but still cheap.

Higher up, network and host artifacts (the tell-tale traces a tool leaves as it runs) and the specific tools an adversary uses are genuinely annoying to replace. At the very top are tactics, techniques, and procedures (TTPs) — how the adversary actually operates. Force a defense up to that level and the attacker must relearn their whole approach. The lesson: aim your detection at the top of the pyramid, not the bottom.

The higher the indicator type, the more it costs an attacker to change, so detection should aim high. Pyramid of Pain TTPs how they operate — hardest Tools their software Artifacts traces left running Domains rotated cheaply IP addresses rented fresh Hash values changed instantly — easiest
The higher the indicator type, the more it costs an attacker to change — so detection should aim high.

From indicator to detection

Indicators only matter when they drive detection. The flow is simple: observe activity across your systems, extract the indicators worth watching, match them against what your telemetry is actually seeing, and raise an alert when something lines up. The higher up the pyramid the indicator sits, the more durable that detection will be.

This is also why sharing indicators matters. One team's observed behavior becomes another team's early warning — provided the indicator is expressed in a common format and shared responsibly, which later articles address.

An indicator becomes protection only when it is matched against live telemetry and acted on. Indicator to alert Observe activity & artifacts Extract the indicators Match against telemetry Alert & act contain, hunt
An indicator becomes protection only when it is matched against live telemetry and acted on.

Behavioral indicators for AI agents

AI agents — software that uses a model to take real actions like calling tools, running code, or fetching web pages — make the case for behavioral indicators sharply. There is often no malicious file to hash and no strange address to block; the attack is a manipulated instruction that makes the agent misuse the legitimate tools it already has. The only reliable trace is behavioral: a sequence of tool calls that does not fit the task.

That maps directly onto the top of the pyramid. An agent suddenly reading files it never touches, or calling an external service out of nowhere, is a behavioral indicator — exactly the kind that is hard for an attacker to avoid and therefore worth watching. Detection for agents should be built on patterns of action, not lists of known-bad strings.

For agents the durable indicator is a tool-call pattern that does not fit the task, caught inside the monitored runtime. Agent behavior as an indicator Monitored agent runtime watch compare trigger Agent tool calls the actions taken Odd sequence does not fit task Behavioral match known-bad pattern Contain pause & review
For agents the durable indicator is a tool-call pattern that does not fit the task, caught inside the monitored runtime.

Key takeaways

  • An indicator of compromise (IOC) is a concrete, matchable trace of an attack — a file, an address, or a behavior.
  • Indicators come in three kinds: atomic (single artifacts), computed (hashes/patterns), and behavioral (sequences of actions).
  • Cheap-to-match indicators like hashes and addresses are also cheap for an attacker to change, so volume is not value.
  • The Pyramid of Pain ranks indicator types by how much denying them hurts the attacker — aim detection at the top.
  • Tactics, techniques, and procedures (TTPs) sit at the apex: force a defense there and the attacker must relearn everything.
  • For AI agents, the durable indicator is behavioral — a tool-call pattern that does not fit the task.

Glossary

Indicator of compromise (IOC)
An observable trace — a file, address, or behavior — suggesting a system has been attacked.
Atomic indicator
An indicator that cannot be broken down further and still mean something, such as an IP address or domain.
Hash
A short fingerprint computed from a file; a computed indicator that changes completely if the file changes at all.
Pyramid of Pain
A public model ranking indicator types by how much it costs an attacker to change them.
Tactics, techniques, and procedures (TTPs)
How an adversary actually operates — the most durable and painful indicator to force them to change.
STIX
The OASIS Structured Threat Information Expression, a public standard format for describing and sharing indicators.