Malware Indicators of Compromise (IoCs): A Defender's Field Guide to Detection, Collection, and Response

Every intrusion leaves fingerprints. The question is whether your telemetry is instrumented to see them — and whether your team can separate a high-fidelity signal from the tsunami of stale, low-context indicators flooding commercial feeds. A recent deep-dive from Recorded Future on malware indicators of compromise (IoCs) reinforces what seasoned responders already know: IoCs remain the connective tissue of modern detection and response, but only when they are collected with rigor, enriched with context, and operationalized into detections that actually fire on adversary behavior instead of burning analyst time on noise.

This matters right now because adversary infrastructure churn has never been faster. Commodity loaders and ransomware affiliates rotate C2 domains and payloads on timescales measured in hours. An IoC program built on static blocklists and unvalidated feeds is already obsolete. What follows is a practitioner's breakdown of the IoC categories that matter, how they are collected, and — most importantly — how to turn them into detection logic, hunt queries, and remediation workflows that hold up in a production SOC.

Technical Analysis: What Malware IoCs Actually Look Like in 2026

Indicators of compromise are forensic artifacts that identify potentially malicious activity on a system or network. Per the Recorded Future analysis, they fall into distinct operational classes, and each class demands a different collection method, confidence treatment, and detection surface.

Atomic and Computed Indicators

File hashes (MD5, SHA-1, SHA-256) are the most brittle indicator type. Modern malware families use polymorphic builders and per-victim packing, meaning hash-based detection has a shelf life measured in days for active campaigns. Hashes remain valuable for triage, retro-hunts during IR, and confirming payload identity — but never as your primary detection layer.

IP addresses and domains used for command-and-control remain the workhorse of network detection. The defensive complication in 2026 is the near-universal adoption of bulletproof hosting rotation, fast-flux DNS, and abuse of legitimate cloud infrastructure (CDN fronting, cloud storage exfiltration, SaaS webhook abuse). A raw IP blocklist without ASN and reputation context will either miss the threat or break the business.

URLs and URI patterns capture exploit kit landing pages, payload staging paths, and phishing infrastructure. URL indicators carry more behavioral context than bare domains and tend to have higher precision.

Behavioral and Host-Based Indicators

This is where mature SOCs live. Behavioral IoCs persist across payload repacking and infrastructure rotation:

• Registry artifacts — Run keys, services, Image File Execution Options hijacks, and WMI subscriptions used for persistence
• Mutexes and named objects — many families create hardcoded mutexes to prevent double-infection; these are gold for host-based sweeping
• Process lineage anomalies — Office applications spawning powershell.exe, mshta.exe, wscript.exe, or rundll32.exe; winword.exe making outbound network connections
• File system artifacts — payloads staged in %TEMP%, %APPDATA%, C:\ProgramData, or C:\Users\Public\ with randomized names; double-extension lures; DLL sideloading next to signed binaries
• Named pipes and service names — lateral movement tooling frequently uses predictable pipe names and service naming conventions

How IoCs Are Collected

Per the Recorded Future write-up, collection pipelines span several sources, each with distinct trust properties:

1. Internal telemetry — sandbox detonations, EDR alerts, and IR case evidence. Highest relevance, highest trust. Your own incident data is your best intel feed.
2. OSINT and community sharing — abuse.ch projects, malware bazaars, research blogs, and ISAC/ISAO exchanges. Free but noisy; requires confidence scoring.
3. Commercial threat intelligence — vendors like Recorded Future aggregate, deduplicate, and enrich indicators with context (threat actor attribution, first-seen/last-seen timestamps, confidence ratings).
4. Structured exchange formats — STIX 2.x over TAXII remains the standard for machine-readable indicator sharing into TIPs and SIEMs.

Exploitation Context

This is not a single-CVE story — it is the operating picture across all of them. In 2025–2026, threat actors continue to weaponize newly disclosed vulnerabilities within days of public disclosure, and the first observable artifact in most of those intrusions is not the exploit itself but the post-exploitation IoC trail: webshells dropped to predictable paths, persistence registry keys, and beaconing to freshly registered domains. That is precisely why a behavioral IoC program outperforms signature-only defense: the vulnerability changes weekly, but the attacker's post-exploitation tradecraft is far slower to evolve.

Detection & Response

The detections below target the high-signal host behaviors described above — the persistence and execution patterns that survive infrastructure rotation. Each was written to minimize false positives in enterprise environments.

Sigma Rules

---
title: Office Application Spawning Script Interpreter or LOLBin
id: 3f8a2c41-7b6d-4e9a-b1c5-8d2e4f6a7b9c
status: experimental
description: Detects Microsoft Office applications spawning script interpreters or living-off-the-land binaries, a hallmark of malicious document execution chains observed across commodity loaders and ransomware initial access.
references:
  - https://attack.mitre.org/techniques/T1204/002/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.initial_access
  - attack.t1204.002
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
      - '\mspub.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\powershell_ise.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate Office add-ins or automation; baseline by parent/child pairs before enforcing
level: high
---
title: Executable Launched From User-Writable Staging Directory
id: 9b4e7d12-3a8f-4c61-9e2b-5f7a1c3d8e6f
status: experimental
description: Detects execution of binaries from directories commonly abused for malware staging, including Public, ProgramData subdirectories, and user Temp folders — a persistent host-based IoC class across droppers and loaders.
references:
  - https://attack.mitre.org/techniques/T1074/001/
  - https://attack.mitre.org/techniques/T1036/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1074.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - '\Users\Public\'
      - '\AppData\Local\Temp\'
  filter_known_good:
    Image|startswith:
      - 'C:\Users\Public\Documents\'
  filter_installers:
    CommandLine|contains:
      - ' /quiet '
      - ' /qn '
  condition: selection and not filter_known_good and not filter_installers
falsepositives:
  - Software installers and update mechanisms staging in Temp; tune per-environment with hash allowlists
level: medium
---
title: Persistence Via Registry Run Key From Suspicious Path
id: 6c1f9a34-2d7e-4b85-a3c9-4e6b2d8f1a5c
status: experimental
description: Detects registry Run/RunOnce key modifications pointing to executables in user-writable or non-standard paths, a durable persistence IoC used by the majority of commodity malware families.
references:
  - https://attack.mitre.org/techniques/T1547/001/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1547.001
logsource:
  category: registry_set
  product: windows
detection:
  selection_key:
    TargetObject|contains:
      - '\CurrentVersion\Run'
      - '\CurrentVersion\RunOnce'
  selection_path:
    Details|contains:
      - '\AppData\'
      - '\Users\Public\'
      - '\Temp\'
      - '\ProgramData\'
  condition: selection_key and selection_path
falsepositives:
  - Per-user installed software (e.g., Teams, OneDrive); allowlist known-good updater paths
level: high

KQL Hunt Query (Microsoft Sentinel / Defender)

This query hunts Office-spawned script interpreters and joins the resulting network connections against a threat intelligence indicator feed — the exact fusion of behavioral detection and IoC matching that the Recorded Future guidance advocates:

// Hunt: Office-spawned LOLBin execution correlated with TI-matched network connections
let OfficeChildren = DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe")
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe")
| project DeviceId, DeviceName, ChildTime=TimeGenerated, ChildProcess=FileName, ChildCmd=ProcessCommandLine, ParentCmd=InitiatingProcessCommandLine;
OfficeChildren
| join kind=inner (
    DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | project DeviceId, NetTime=TimeGenerated, RemoteIP, RemoteUrl, RemotePort
) on DeviceId
| where NetTime between (ChildTime .. ChildTime + 10m)
// Correlate against ingested threat intelligence indicators (IoC matching)
| join kind=leftsemi (
    ThreatIntelligenceIndicator
    | where TimeGenerated > ago(30d)
    | where isnotempty(NetworkIP) or isnotempty(Url)
    | extend MatchValue = coalesce(NetworkIP, Url)
) on $left.RemoteIP == $right.NetworkIP
| summarize Connections=make_set(RemoteUrl), IPs=make_set(RemoteIP) by DeviceName, ChildProcess, ChildCmd, ChildTime
| order by ChildTime desc

For environments ingesting firewall/DNS via CEF, swap DeviceNetworkEvents for CommonSecurityLog and match DestinationIP or RequestURL against ThreatIntelligenceIndicator fields — the correlation logic is identical.

Velociraptor VQL Hunt Artifact

When you need to sweep a fleet for persistence IoCs and suspicious staging artifacts — for example after a feed ingest flags a new campaign — this artifact collects Run key entries and cross-references executables in user-writable paths:

-- Hunt: Persistence IoCs - Run keys pointing to user-writable paths and staged binaries
SELECT
    Key.FullPath AS RegKey,
    Key.Name AS ValueName,
    Value.Data AS Command,
    stat(filename=Value.Data) AS FileStat
FROM foreach(row={
    SELECT FullPath FROM glob(glob='HKLM/Software/Microsoft/Windows/CurrentVersion/Run*')
}, query={
    SELECT Key, Value FROM stat(filename=Key.FullPath)
})
WHERE Command =~ '(?i)(appdata|users\\\\public|temp|programdata)'

For a complementary process-level sweep matching known-bad command-line patterns from a current campaign:

-- Hunt: Live process sweep for malicious command-line IoC patterns
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(-enc |frombase64string|downloadstring|iex \(|invoke-expression|certutil -decode|mshta http|rundll32 .*javascript)'
   OR Exe =~ '(?i)(users\\\\public|appdata\\\\local\\\\temp)'

Remediation and Verification Script

When an IoC sweep confirms a hit — a malicious Run key, a staged binary, an active beacon — speed matters. This PowerShell script audits persistence locations, kills matching processes, quarantines staged payloads, and exports evidence before remediation:

# Malware IoC Sweep and Containment Script
# Run elevated. Review output before enabling -Contain switch in production.
param(
    [switch]$Contain,
    [string]$EvidencePath = "C:\IR_Evidence_$(Get-Date -Format 'yyyyMMdd_HHmmss')"
)

New-Item -ItemType Directory -Path $EvidencePath -Force | Out-Null
$suspiciousPaths = 'AppData|Users\\Public|\\Temp\\|ProgramData'

# 1. Audit Run/RunOnce persistence keys for suspicious target paths
$runKeys = @(
    'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run',
    'HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce',
    'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
    'HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce',
    'HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run'
)
$findings = foreach ($key in $runKeys) {
    if (Test-Path $key) {
        Get-ItemProperty $key | Get-Member -MemberType NoteProperty | ForEach-Object {
            $val = (Get-ItemProperty $key).($_.Name)
            if ($val -match $suspiciousPaths) {
                [PSCustomObject]@{ Key=$key; ValueName=$_.Name; Command=$val }
            }
        }
    }
}
$findings | Export-Csv "$EvidencePath\suspicious_runkeys.csv" -NoTypeInformation

# 2. Identify running processes executing from staging directories
$susProcs = Get-CimInstance Win32_Process | Where-Object {
    $_.ExecutablePath -match $suspiciousPaths
}
$susProcs | Select-Object ProcessId, Name, ExecutablePath, CommandLine |
    Export-Csv "$EvidencePath\suspicious_processes.csv" -NoTypeInformation

# 3. Capture active network connections for beaconing review
Get-NetTCPConnection -State Established |
    Where-Object { $_.RemoteAddress -notmatch '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)' } |
    Select-Object LocalPort, RemoteAddress, RemotePort, OwningProcess |
    Export-Csv "$EvidencePath\external_connections.csv" -NoTypeInformation

# 4. Containment (explicit opt-in): kill suspicious processes and remove malicious Run values
if ($Contain) {
    foreach ($p in $susProcs) {
        Stop-Process -Id $p.ProcessId -Force -ErrorAction SilentlyContinue
    }
    foreach ($f in $findings) {
        Remove-ItemProperty -Path $f.Key -Name $f.ValueName -Force -ErrorAction SilentlyContinue
    }
    Write-Host "[+] Containment actions applied. Evidence preserved at $EvidencePath" -ForegroundColor Green
} else {
    Write-Host "[!] Audit-only mode. Re-run with -Contain after reviewing findings in $EvidencePath" -ForegroundColor Yellow
}

Remediation and Program Hardening

There is no patch for this threat class — the fix is programmatic. Based on the collection and response practices outlined by Recorded Future and fifteen years of watching IoC programs succeed and fail, these are the controls that matter:

1. Score and expire every indicator. Enforce confidence scoring and time-to-live on ingested IoCs. A C2 domain from a campaign that went quiet 90 days ago is an FP generator, not a detection. Automate expiry in your TIP before indicators ever reach the SIEM.
2. Prioritize behavioral over atomic indicators. Hash and IP feeds are triage aids. Invest detection engineering effort in behavior: parent/child process relationships, persistence writes, and beaconing periodicity. These survive adversary retooling.
3. Close the IR feedback loop. Every incident your team works produces the highest-fidelity indicators you will ever own. Mandate that IR case artifacts (mutexes, paths, registry keys, C2 endpoints) are exported back into the detection pipeline within 24 hours of case closure.
4. Validate feeds against your environment. Before enabling blocking on any third-party indicator set, run it in detect-only mode for two weeks. Measure hit rates and false positives. Recorded Future and similar vendors provide confidence and risk scores — use them as gating thresholds.
5. Instrument retro-hunting capability. When a new campaign IoC set drops, your first question is "have we already seen this?" Maintain the ability to sweep 30–90 days of historical process, network, and DNS telemetry on demand (the KQL and VQL above are built for exactly this).
6. Standardize sharing with STIX/TAXII. If you are exchanging indicators with ISACs or peers in unstructured formats (spreadsheets, PDFs, email), you are introducing delay and transcription error into the most time-sensitive data in your program.
7. Test your detections. Atomic Red Team and controlled detonations of sandboxed samples validate that the IoC-to-detection pipeline actually fires. A detection that has never been tested is a hope, not a control.

The adversaries are not standing still, and neither is the indicator landscape. But the defenders who win are not the ones with the largest feeds — they are the ones who treat IoCs as perishable, contextual intelligence and build response muscle around the behaviors that persist.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub