Is an indicator of compromise, the hash or IP address a security team blocks, a low-grade tactical item? Chenta Lee says that view is wrong. In a LinkedIn article titled “IoCs are still strategic,” published in July 2023, he argues the industry has drifted away from IoCs without good reason.
Lee starts from a 2020 article by Andy Piazza on getting more value from IoCs, which he calls still relevant three years on. What worries him is the shift in focus from IoCs to Indicators of Behavior. The move is not a problem in itself, he writes, but it suggests IoCs are being valued less. He traces that to the threat intelligence pyramids the field has built. One puts IoCs at the bottom with tactics, techniques and procedures above. Another splits intelligence into tactical, operational and strategic layers. Overlap the two and IoCs look like a tactical afterthought. Lee asks whether that follows: “just because IoCs are at the base, does that necessarily make them less strategic?”
What detections actually run on
His team reviewed many existing detections, including SIGMA and STIX patterning, and found many still lean heavily on IoCs. Behavior-based detections often need IoCs to spot new procedures. In some EDR and XDR products, IoC-centric detections make up the majority.
Attackers still have to touch operating systems and use the internet to communicate, Lee writes, so there are always IoCs to catch the latest threats. The real difficulty is how short their life cycle has become. Malware-as-a-Service on the dark web produces new malware with every deployment, and new DGA domains for command and control appear every hour. Still, creating fresh IoCs costs attackers money, so there is always a window when they stay unchanged. Detection built on IoCs works well if new ones reach the pipeline in real time.
A vertical layer
Lee’s proposal is to stop picturing IoCs as one rung of the pyramid. He sees them as a vertical layer running through every level.
Tactical IoCs let organizations react fast, with no approvals needed. A firewall blocks a scanning IP at the edge, and L1 and L2 analysts isolate devices hit by ransomware. These should be high in volume and detection rate and low in false positives.
Operational IoCs tie detections to response playbooks. They need enough context to help analysts improve detections and plan mitigation, with a manageable false positive rate.
Strategic IoCs inform security and business decisions. If a company keeps turning up on the dark web, Lee says, the CEO might delay a product launch until the new risk is understood. If employee credentials leak, the CSO may need to change identity and access policies and widen staff training. If a SOC sees IoCs tied to a specific threat group, the company may have to prepare to work with law enforcement and revise its playbooks. These strategic IoCs may be fewer and noisier, he writes, but their influence on planning is unmatched.
His conclusion is about speed: whoever can obtain and deploy the latest IoCs across the threat management pipeline wins.
