Examples of Indicators of Compromise

While the indicators above are general signs to watch out for, there are some examples of how those might look in the wild. These are some examples of indicators of compromise:

Outbound traffic during off-hours. If a business site is receiving a large amount of outbound traffic outside of business hours, it could be an indicator of compromise. Attackers could be located anywhere in the world and working at different times, so if there is a lot of unusual traffic or activity at off-hours, that could be an indicator to explore.

High-ranking user irregularities with sensitive data. High-ranking users often have access to sensitive information, but if a business starts seeing unusual or irregular activity on these profiles, it could indicate a compromise.

Activity from unusual geographic locations. Attackers could be located anywhere, so if there's an unusual spike in activity from somewhere where users normally aren't located, there could be a problem. This is especially true for small businesses since most of their activity is local. A spike in activity from a distant location could indicate a compromise.

A high number of authentication failures. Attackers will often attempt to authenticate sign-ins as they figure out a way into a system, so companies may need to increase security if there's a high number of failures.

High number of requests on secure files. A high number of requests for secure files could indicate that someone without access is trying to find a way to reach the secure data, and that could be an indicator of compromised security.

Configuration changes. If a business notices changes in any system configurations being made without permission, it could indicate that an attacker is trying to use malware and changing the system to allow it.

Changes in mobile device profiles. Mobile devices can be a weak point in a system, so changes being made for mobile device profiles could be an indicator that an attacker is trying to find access to a system.