Indicators of compromise (IOCs)

Pieces of evidence, such as suspicious files, IP addresses, domains or unusual activity, that suggest a system or network may have been breached.

Indicators of compromise are the clues left behind by an attack. Technical examples include known malicious file hashes, IP addresses and domains linked to attacker infrastructure, and unexpected new administrator accounts. Behavioural signs include sign-ins from unusual countries, new email forwarding rules that send messages outside the company, large data transfers at odd hours and security tools being switched off.

Security vendors and agencies, including the Canadian Centre for Cyber Security, share IOCs so organizations can check whether they have been affected by a known campaign. For a small business, the most useful indicators are often simple ones that staff or IT can notice, such as colleagues receiving strange emails from your account or files being renamed with unfamiliar extensions.

Practical tip: ask your IT provider to set up alerts for high-value warning signs in your email and identity systems, especially new inbox forwarding rules and sign-ins from unexpected locations. These are among the most common early signs of business email compromise.